CI：诊断 pre-commit 仅装于用户态导致 SYSTEM 不可见

第五次运行（run#5）L0 仍失败，但错误信息已指向真因：
自检步骤 3 个候选解释器（msys64 / .venv / anaconda3）全部探测失败。

根因（已实测定位）：本机 pre-commit 装在
  C:\Users\Administrator\AppData\Roaming\Python\Python312\site-packages
即 Administrator 的【用户态 user-site】。runner 以 SYSTEM 运行，其
%APPDATA% = C:\Windows\system32\config\systemprofile\AppData\Roaming，
根本看不到该目录 → 换任何 python.exe 路径都无效。
（已盘点本机全部 python：anaconda3 3.12.4 / workbuddy 3.13.12 /
 msys64 3.14.5，以 -s 禁用 user-site 后 pre-commit 均为 rc=1。）

本次改动（workflow 侧，配合外部的全局安装）：
- 探测改用 `& $py -s -m pre_commit --version`（-s 禁用 user-site），
  只有 SYSTEM 真能用的解释器才被选中
- 后续 install / run 同步加 -s，保持判定一致
- 失败信息明确指向 user-site 不可见 + 给出修复脚本路径
  （install_precommit_global.ps1，装到 anaconda3 全局 site-packages）

真正的修复需管理员执行该脚本（本会话无提权权限，pip --no-user
报 WinError 5 拒绝访问）。装好后 L0 即可通过。

.gitea/workflows/ci.yml

@@ -89,10 +89,16 @@ jobs:
           # no pre-commit). Probe the same order as scripts/ci_local.py:
           #   PATH python -> .venv -> anaconda3
           #
-          # CAUTION: a failing native command writes to stderr; with
+          # CAUTION 1: a failing native command writes to stderr; with
           # $ErrorActionPreference='Stop' that would abort the whole script
           # (NativeCommandError) before the next candidate is tried. So relax
           # the preference around each probe, and restore it afterwards.
+          #
+          # CAUTION 2: pre-commit may be installed in the USER site of some
+          # account (e.g. %APPDATA%\Roaming\Python\...), which SYSTEM cannot
+          # see at all -- no python.exe path can help then. Probe with `-s`
+          # (no user-site) so we only accept an interpreter that works for
+          # SYSTEM, and say so clearly when none is found.
           $candidates = @(
             (Get-Command python -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source),
             (Join-Path $repoRoot '.venv\Scripts\python.exe'),
@@ -104,19 +110,21 @@ jobs:
             if (-not $c) { continue }
             if (-not (Test-Path $c)) { continue }
             $ErrorActionPreference = 'Continue'
-            & $c -m pre_commit --version 2>&1 | Out-Null
+            & $c -s -m pre_commit --version 2>&1 | Out-Null
             $rc = $LASTEXITCODE
             $ErrorActionPreference = $saved
             if ($rc -eq 0) { $py = $c; break }
           }
           $ErrorActionPreference = 'Stop'
           if (-not $py) {
-            Write-Host "::error::no Python with pre-commit found. Tried: $($candidates -join ' | ')"
+            Write-Host "::error::no Python with a SYSTEM-visible pre-commit. Tried: $($candidates -join ' | ')"
+            Write-Host "::error::pre-commit is probably installed only in a USER site (invisible to SYSTEM)."
+            Write-Host "::error::fix (elevated): powershell -ExecutionPolicy Bypass -File D:\Docker\act_runner\install_precommit_global.ps1"
             exit 1
           }
           Write-Host "using python: $py"
           & $py --version
-          & $py -m pre_commit --version
+          & $py -s -m pre_commit --version
           "PYTHON=$py" | Out-File -FilePath $env:GITHUB_ENV -Append
 
           # --- cppcheck -----------------------------------------------------
@@ -140,7 +148,7 @@ jobs:
 
       - name: 安装 pre-commit 钩子到本仓库
         shell: powershell
-        run: "& $env:PYTHON -m pre_commit install --install-hooks"
+        run: "& $env:PYTHON -s -m pre_commit install --install-hooks"
 
       - name: 决定跳过哪些钩子（Keil 依赖）
         id: skip
@@ -163,7 +171,7 @@ jobs:
           SKIP: ${{ steps.skip.outputs.value }}
         run: |
           if ($env:SKIP) { Write-Host "SKIP=$env:SKIP" }
-          & $env:PYTHON -m pre_commit run --all-files --show-diff-on-failure
+          & $env:PYTHON -s -m pre_commit run --all-files --show-diff-on-failure
           if ($LASTEXITCODE -ne 0) {
             Write-Host "::error::L0 static gates failed (see output above)"
             exit $LASTEXITCODE