Prepare authenticated lifecycle runtime and production release candidate

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

tests/test_dependency_pins.py

@@ -0,0 +1,15 @@
+"""Prevent a tested dependency and its shipped container pin from diverging."""
+from pathlib import Path
+import re
+import tomllib
+
+
+def test_container_dependencies_match_project_lock():
+    root = Path(__file__).resolve().parents[1]
+    lock = tomllib.loads((root/'uv.lock').read_text())
+    locked = {p['name'].lower(): p['version'] for p in lock['package']}
+    requirements = dict(re.findall(r'^([a-zA-Z0-9_-]+)==([^ ;\\\n]+)',
+                                   (root/'requirements.lock').read_text(), re.MULTILINE))
+    assert requirements
+    for name, version in requirements.items():
+        assert locked[name.lower()] == version, name