fix(ci): make reboot readiness audit portable without rg

scripts/reboot-recovery/reboot-recovery-readiness-audit.sh

@@ -84,11 +84,40 @@ require_dir() {
   fi
 }
 
+pattern_present() {
+  local pattern="$1"
+  local path="$2"
+  if [ ! -f "$path" ]; then
+    return 1
+  fi
+  if command -v rg >/dev/null 2>&1; then
+    rg -q -- "$pattern" "$path"
+    return $?
+  fi
+  # Gitea runner images do not always provide ripgrep; keep this audit portable.
+  python3 - "$pattern" "$path" <<'PY'
+import re
+import sys
+import warnings
+from pathlib import Path
+
+pattern = sys.argv[1]
+path = Path(sys.argv[2])
+try:
+    text = path.read_text(encoding="utf-8")
+except UnicodeDecodeError:
+    text = path.read_text(encoding="utf-8", errors="ignore")
+
+warnings.filterwarnings("ignore", category=FutureWarning)
+sys.exit(0 if re.search(pattern, text) else 1)
+PY
+}
+
 require_pattern() {
   local pattern="$1"
   local path="$2"
   local label="$3"
-  if rg -q "$pattern" "$path"; then
+  if pattern_present "$pattern" "$path"; then
     ok "$label present in $path"
   else
     blocked "$label missing in $path"
@@ -99,7 +128,7 @@ forbid_pattern() {
   local pattern="$1"
   local path="$2"
   local label="$3"
-  if rg -q "$pattern" "$path"; then
+  if pattern_present "$pattern" "$path"; then
     blocked "$label forbidden pattern present in $path"
   else
     ok "$label forbidden pattern absent in $path"