[kcrmin]

What and why

pyproject.toml pins the direct dependencies, but nothing pinned the transitive
set, so two image builds could ship different bytes. This adds hash-locked sets
from uv pip compile --universal --generate-hashes:

• requirements/runtime.txt (31 packages): what the image ships
• requirements/dev.txt (71 packages): runtime plus the test and dev extras

The Dockerfile installs runtime.txt wheels-only with --require-hashes, then
the project with --no-deps and pip check. Every CI gate installs from the
lock the same way. gate2 now fails when pyproject.toml and requirements/
drift (extras included, runtime pins equal in both files), and gate5 imports
the app from the runtime lock alone. DEVELOPMENT.md documents regeneration.

Depends on #103. This branch starts from it, so until #103 (and #102) merge the
diff also shows their two commits. Paired with the data-pipeline branch of the
same name, build/lock-python-dependencies. Related: #104.

Verified

• Regenerating both files with uv 0.13.5 reproduces them exactly, header aside
• python:3.12.13-slim-bookworm on linux/arm64 and linux/amd64 (QEMU): both
  locks install wheels-only with --require-hashes, pip check is clean, the
  gate2 lock check passes, and backtest_engine.api, .worker and
  .orchestrator import from the runtime lock alone
• Native arm64 docker build --no-cache: builds, pip check clean; inside it,
  as user app, import backtest_engine.api, backtest_engine.worker works and
  perl stays purged
• Gates 1-4 from requirements/dev.txt on linux/arm64: ruff clean; mypy no
  issues in 74 files; pytest 1415 passed, 6 skipped (CI on build(deps): cap sqlalchemy below 2.2 #103: 1414, plus the
  new Dockerfile test), coverage 77.62%; contract tests pass
• macOS: the dev lock installs; pip check, the lock check, ruff and mypy pass
• Drift fails: bumping pytest in pyproject.toml fails the gate2 lock check,
  bumping fastapi fails pip check
• Merges cleanly with chore(ci): tidy backtest gates and macos skip #104, and coverage stays above its 77% floor

Checklist

• Image and every gate install the same locked versions
• A stale lock fails CI instead of shipping
• No job renamed and no runtime code change
• Related: fix(backtest): annotate scalar_one results #102, build(deps): cap sqlalchemy below 2.2 #103, chore(ci): tidy backtest gates and macos skip #104