build: add hashed Python 3.11 CI lock

[WalksWithASwagger]

Closes #329

Summary

• add a fully pinned, hashed CPython 3.11 Linux x86_64 CI dependency graph
• install the lock with --require-hashes and audit that exact graph in CI
• add deterministic pip-tools regeneration plus a Linux CI no-diff check
• preserve ranged source requirements for cross-platform user installs

Acceptance Self-Check

• Every pinned package in requirements-ci.txt has at least one SHA-256 hash
• CI installs the Python 3.11 lock with --require-hashes
• Human-edited runtime and development requirements remain readable source contracts
• Documentation distinguishes the Linux CI lock from cross-platform user installation
• npm run lock:python-ci deterministically targets CPython 3.11 manylinux x86_64
• CI regenerates the lock and fails on any diff
• A clean hash-installed Python 3.11 environment passes Ruff and the full Python suite

Verification

• empty Python 3.11 virtualenv installed requirements-ci.txt with --require-hashes
• clean locked environment: Ruff passed; 553 tests passed, 1 skipped
• canonical npm run verify: 554 Python tests and 7 frontend tests passed; build, portal E2E, docs, public boundary, dry-run smoke, package boundary, and doctor passed
• repeated regeneration under the locked pip/pip-tools versions produced no diff
• pip-audit -r requirements-ci.txt: no known vulnerabilities
• Varlock environment audit and staged scan passed
• git diff --check passed

The 1,291-line generated lock is the intentional bulk of this 10-file change. No provider calls, global installs, package-manager migration, deployment, or unrelated dependency upgrade was performed.

[github-actions]

Agentic PR Review

Verdict: needs-human

Checks:

• Linked issue via Closes #... or Refs #...: yes
• Issue acceptance criteria found: 6
• PR verification section present: yes
• PR acceptance self-check present: yes
• Diff within v1 limits: no

This PR is not blocked from human review, but the agentic gate is not satisfied.