refactor: update bandit arguments and change pytest entry to use a script

.pre-commit-config.yaml

@@ -37,8 +37,7 @@ repos:
     rev: 1.7.9
     hooks:
       - id: bandit
-        # B104: intentional LAN listeners, B105: setup-required placeholder credentials.
-        args: ["-q", "-l", "-i", "-s", "B104,B105"]
+        args: ["-q", "-l", "-i"]
         files: ^.*\.py$
         exclude: ^tests/
 
@@ -47,7 +46,7 @@ repos:
     hooks:
       - id: pytest
         name: pytest
-        entry: python -m pytest -q
+        entry: ./scripts/precommit-pytest.sh
         language: system
         pass_filenames: false
         always_run: true

scripts/precommit-pytest.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Prefer the currently activated venv, then repo-local .venv, then python3/python.
+if [ -n "${VIRTUAL_ENV:-}" ] && [ -x "${VIRTUAL_ENV}/bin/python" ]; then
+  PYTHON_BIN="${VIRTUAL_ENV}/bin/python"
+elif [ -x ".venv/bin/python" ]; then
+  PYTHON_BIN=".venv/bin/python"
+elif command -v python3 >/dev/null 2>&1; then
+  PYTHON_BIN="python3"
+elif command -v python >/dev/null 2>&1; then
+  PYTHON_BIN="python"
+else
+  echo "No Python interpreter found for pytest hook." >&2
+  exit 1
+fi
+
+exec "${PYTHON_BIN}" -m pytest -q