The runner's semgrep install failed trying to replace Debian's apt-managed PyJWT
("Cannot uninstall PyJWT ... RECORD file not found"). --ignore-installed installs
semgrep's deps fresh without uninstalling the apt copies, staying within the
runner's constraints (no setup-python, no container job).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>