ci: document fixed policy verifier subprocess

yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/public_policies.py

@@ -3,7 +3,8 @@ from __future__ import annotations
 import hashlib
 import json
 import re
-import subprocess
+# The verifier runs via a fixed Python interpreter and never invokes a shell.
+import subprocess  # nosec B404
 import sys
 from datetime import UTC, datetime
 from pathlib import Path
@@ -602,7 +603,8 @@ def _run_policy_verifier(*, policy_dir: Path, approval_file: Path, keyring_file:
     script = next((candidate for candidate in candidates if candidate.is_file()), None)
     if script is None:
         raise PublicPolicyError("Policy verifier is unavailable.")
-    completed = subprocess.run(
+    # The executable and script are fixed; evidence paths remain plain argv values.
+    completed = subprocess.run(  # nosec B603
         [sys.executable, str(script), "verify", "--approval-file", str(approval_file), "--keyring-file", str(keyring_file), "--policy-dir", str(policy_dir), "--checked-at", _as_utc(checked_at).isoformat()],
         check=False, capture_output=True, text=True, timeout=20,
     )