# DEVX-175: Badge generation must honor repo bandit configuration

## Problem

`collect_quality()` in `generate_badges.py` runs `bandit -r src/` with no
config file. Repos that declare a `[tool.bandit]` section in
`pyproject.toml` (skip lists aligned with infrastructure patterns — for
example sso-bridge skips B404/B603/B501) lint clean via `make lint-all`, but the
quality badge still reports `bandit: FAIL` — a false-FAIL badge that
contradicts the actual lint gate.

## Approach

REQ-1: When `pyproject.toml` exists in the target repo and contains a
`[tool.bandit]` section, pass `-c pyproject.toml` to the bandit invocation
in `collect_quality()`.

REQ-2: Repos without `[tool.bandit]` keep the current invocation unchanged.

## Test Plan

- Unit test: repo fixture with `[tool.bandit]` → command includes
  `-c pyproject.toml`; without the section → plain invocation.
- Manual: `python -m devx.tools.generate_badges` in sso-bridge reports
  `bandit: pass`.

## Deploy Plan

devx release → repos pick it up on next devx pin bump; no infra changes.

## Rollback Plan

Revert the commit; badges revert to unconfigured bandit runs.

## Acceptance Criteria

- [x] REQ-1 implemented with `# Implements: REQ-1` comment
- [x] REQ-2 preserved (no config → unchanged command)
- [x] Unit tests cover both branches
- [x] `make lint-all` + `make pytest-cov` pass in devx