Fresh-venv installs started failing with pip ResolutionTooDeep because
requirements.txt is unpinned. Constrain CI and image builds to the
frozen, test-passing local set; requirements.txt stays the source of
intent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
