CI: pip-audit fails on lightning 2.6.5 (PYSEC-2026-3624) — blocks all PRs

Problem

The pip-audit (deps) CI check is failing on lightning 2.6.5 and blocks every open PR (surfaced on #87, but not specific to it).

Found 1 known vulnerability, ignored 1 in 1 package
lightning 2.6.5  PYSEC-2026-3624

Advisory: PYSEC-2026-3624 — remote code execution in _load_state: crafted checkpoint files import and execute attacker-controlled module names from _instantiator hyperparameters, bypassing weights_only=True, when LightningModule.load_from_checkpoint is called.

Impact

• Blocks merges across the repo — any PR against main hits this red check.
• Real exposure only when loading untrusted checkpoints; our own training/predict flows load our own checkpoints, so runtime risk is low, but CI is (correctly) hard-failing.

Options

1. Bump lightning to a version that resolves the advisory (proper fix — needs a compatibility/reproducibility check against our training baselines).
2. Add PYSEC-2026-3624 to ignore-vulns in .github/workflows/ci-build.yaml with a justification comment (matching the existing torch/pygments/cryptography entries), if no fixed version is viable yet.

Acceptance criteria

• pip-audit (deps) passes on main and PR branches.
• If ignored rather than upgraded, the ignore entry has a dated justification and a follow-up to upgrade when a fix lands.

Filed while unblocking #87 (DCO fixed there; this was the remaining red check).