build: add a reproducible hashed Python 3.11 CI lock

[WalksWithASwagger]

Summary

Add a reproducible, hashed Python 3.11 Linux dependency lock for CI while preserving flexible source requirements for users.

Context

• Blocked by build: align fresh-clone setup with the canonical verification gate #321 and frontend: add a focused unit and component test foundation #328 so .github/workflows/ci.yml changes are serialized.
• Roadmap phase: Phase 1 - dependency health
• Relevant files: requirements.txt, requirements-dev.txt, a new CI lock file, .github/workflows/ci.yml, README.md, and CONTRIBUTING.md
• Current behavior: CI resolves ranged Python requirements afresh, so transitive versions and audit results can drift between runs.
• Desired behavior: Python 3.11 Linux CI installs one reviewed, fully pinned, hashed graph with a documented refresh procedure.

Implementation Notes

• Keep direct ranged requirements as the human-edited source contract.
• Use one existing/lightweight compilation tool and record the exact deterministic refresh command.
• Scope the lock explicitly to Python 3.11 on Linux; do not imply it is a universal user lock.
• Install the lock with hash verification in CI.

Acceptance Criteria

• A fully pinned transitive CI lock contains hashes for every artifact.
• CI installs the lock with --require-hashes on Python 3.11 Linux.
• Direct dependency ranges remain readable source requirements.
• Documentation distinguishes CI reproduction from supported cross-platform user installation.
• One deterministic lock refresh/check command is documented.
• A clean virtual environment passes Ruff and the full Python test suite.

Tests/Evals

• Verify the lock from an empty Python 3.11 virtual environment.
• Do not install globally or run provider-capable commands.

Verification

• Install the CI lock in a disposable Python 3.11 virtual environment with --require-hashes.
• python3 -m ruff check .
• npm test
• npm run docs:check
• Confirm regenerating the lock produces no diff.

Agent Instructions

• Use branch codex/issue-<this-issue>-python-ci-lock.
• Do not start until build: align fresh-clone setup with the canonical verification gate #321 and the frontend test foundation are merged.
• Do not migrate package managers or narrow public Python support.
• Never read local environment value files.

Human Checkpoints

• Stop if the selected resolver cannot produce stable hashes for the supported CI platform.

Out of Scope

• Poetry, uv, or a project-wide packaging migration.
• Locking every operating system and Python version.
• Application dependency upgrades unrelated to resolution.
• Global package installation.

Linear

Not applicable. Rafiki delivery is GitHub-only; do not create or update a Linear issue.

[WalksWithASwagger]

Implementation is complete in PR #356 at exact head 06fa26f. Local and hosted Linux verification pass, including hash-enforced install, deterministic Linux regeneration, locked-graph audit, full tests, review, policy, and secret scan. Automation applied needs-human only because the required generated requirements-ci.txt is 1,291 lines and exceeds the v1 diff limit. A maintainer must approve that generated-lock size exception before merge.