ci: install pinned report renderer dependency

Author: bx33661

.github/workflows/validate.yml

@@ -25,5 +25,7 @@ jobs:
           python-version: "3.12"
       - name: Install dependencies
         run: npm ci
+      - name: Install Python dependencies
+        run: python -m pip install --disable-pip-version-check -r skills/omv-report/scripts/requirements.txt
       - name: Validate project
         run: npm run release:check

README.md

@@ -26,7 +26,7 @@ Research state stays in a private `.omv/` workspace. The project is designed for
 
 ## Quick Start
 
-**Requirements:** [Codex](https://developers.openai.com/codex/) or [Claude Code](https://docs.anthropic.com/en/docs/claude-code), Node.js 22 or later, and Python 3 for bundled Skill helpers. Windows, Linux, and macOS are supported; on Windows, use a modern Windows Terminal or PowerShell for the Ink workspace.
+**Requirements:** [Codex](https://developers.openai.com/codex/) or [Claude Code](https://docs.anthropic.com/en/docs/claude-code), Node.js 22 or later, and Python 3 for bundled Skill helpers. The deterministic report renderer additionally uses its pinned PyYAML dependency. Windows, Linux, and macOS are supported; on Windows, use a modern Windows Terminal or PowerShell for the Ink workspace.
 
 Install the CLI and add the skills to Codex:
 

README.zh-CN.md

@@ -26,7 +26,7 @@
 
 ## 快速开始
 
-**环境要求：** [Codex](https://developers.openai.com/codex/) 或 [Claude Code](https://docs.anthropic.com/en/docs/claude-code)、Node.js 22 或更高版本，以及供内置 Skill 辅助脚本使用的 Python 3。支持 Windows、Linux 和 macOS；Windows 建议使用新版 Windows Terminal 或 PowerShell 运行 Ink 工作台。
+**环境要求：** [Codex](https://developers.openai.com/codex/) 或 [Claude Code](https://docs.anthropic.com/en/docs/claude-code)、Node.js 22 或更高版本，以及供内置 Skill 辅助脚本使用的 Python 3。确定性报告渲染器还使用自身固定版本的 PyYAML 依赖。支持 Windows、Linux 和 macOS；Windows 建议使用新版 Windows Terminal 或 PowerShell 运行 Ink 工作台。
 
 全局安装 CLI，并把 Skills 装入 Codex：
 

skills/omv-report/SKILL.md

@@ -85,6 +85,8 @@ Use the validation result to choose output mode:
 
 For confirmed findings with submission score ≥ 75, run the deterministic renderer first to get a pre-filled skeleton. Resolve `scripts/render_template.py` relative to this installed `SKILL.md`; do not assume one global install directory.
 
+The renderer requires the pinned Python dependency in `scripts/requirements.txt`. Install it once with `python3 -m pip install -r <installed-skill-dir>/scripts/requirements.txt` on macOS/Linux or `py -3 -m pip install -r <installed-skill-dir>\scripts\requirements.txt` on Windows.
+
 macOS/Linux:
 
 ```bash

skills/omv-report/scripts/render_template.py

@@ -24,7 +24,13 @@
 from pathlib import Path
 from typing import Any
 
-import yaml
+try:
+    import yaml
+except ModuleNotFoundError:
+    raise SystemExit(
+        "PyYAML is required by the deterministic report renderer. "
+        "Install it with: python -m pip install -r scripts/requirements.txt"
+    )
 
 
 GHSA_ECOSYSTEM: dict[str, str] = {

skills/omv-report/scripts/requirements.txt

@@ -0,0 +1 @@
+PyYAML==6.0.3