fix(ci): sync Stage2C lock with declared test dependencies

[LIHUA919]

Summary

Stage 2C's hash-locked Python environment fails test collection with ModuleNotFoundError: No module named 'PIL' in both e2e shards. Its lock omitted three dependencies already declared by the test extra.

• Regenerate the Linux/Python 3.11 lock with the recorded uv 0.11.26 command, adding Pillow, resvg-py and defusedxml. All existing package pins stay unchanged.
• Check that the lock satisfies the declared runtime, test and build-tool requirements, including target-platform markers.

The owner is the existing Stage 2C test environment. Production dependencies, workflow selection and acceptance thresholds are unchanged; no frontend interaction changes are needed. The related maintenance improvement is the declaration-to-lock regression check.

Validation

• Reproduced the PIL collection error in an isolated Python 3.11 environment installed from the old hash lock.
• Updated hash-lock installation, source Chat bundle rebuild, source wheel build/hash-verified install and pip check pass.
• Both complete Stage 2C collection commands pass: 129 and 128 selected tests. Collection is not execution.
• Dependency-lock and public-source-reader tests: 37 passed. Each missing new dependency and an incompatible Pillow pin are rejected by the regression check.
• Ruff and diff checks pass.

Local verification used macOS/Python 3.11.9 and qualified Node 22.22.3. A Linux container was unavailable; full Linux Stage 2C execution and replacement PR CI remain required. This repair does not qualify formal SQLite D2 capacity or promotion.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

Exact head: 4215bdafe80c16a38773bc55172ce2473d552146. Whole-PR base: 5c62c5c03f13cc84176338100f2bded12801530e.

动机

通过固定依赖运行 Stage 2C 资格测试的维护者和贡献者。 原锁文件缺少已声明的图像测试依赖，Linux 安装成功后 pytest 仍因找不到 PIL 而在收集阶段中断；补齐三个依赖后，两个分片恢复 129/128 项收集，不必逐次手工补装。 独立 Linux x86_64/Python 3.11 对照确认哈希安装和源码 wheel 可用，两个分片均完成收集，相关 37 项测试通过；新增检查能拒绝漏依赖和不兼容版本。 本次只恢复测试环境并加依赖一致性回归；不改变生产依赖、工作流、权限或 Stage 2C 用例语义，也不声称完整端到端、mutants 和安装资格任务全部执行通过。

改动思路

依赖声明继续由 pyproject 和既有 build-tools 输入负责，uv 生成的锁文件是安装投影；新增测试只比较声明与 Linux/Python 3.11 目标锁，不成为第二个 resolver。不改现有工作流、不升级其余 50 个 pin，即可恢复实际环境。单独补锁会留下下次声明漂移的风险，一条从声明推导的普通 pytest 检查足够，无需新烟测框架。

具体改动

完整差异为两个文件、212 行新增：锁文件 153 行是 defusedxml 0.7.1、Pillow 12.3.0、resvg-py 0.5.0 的固定版本/公开哈希；新增测试 59 行。规范依据 docs/development/testing-and-quality.md，不可变版本 5c62c5c03f13cc84176338100f2bded12801530e；既有章节 Local Validation Environment / 本地验证环境 要求显式解释器、测试依赖及固定/哈希校验安装路径，本 head implemented，由下面的 Linux 安装、源码 wheel 和收集对照验证。

关键内容讲解

锁文件保留全部 50 个旧 pin；真实 Linux pip --require-hashes --only-binary=:all: 接受新增二进制包与哈希。test_stage2c_lock_covers_runtime_test_and_build_requirements 从 runtime/test extra/build-tools 输入读取要求，按规范化名称检查 pin，并用 packaging 验证版本范围；marker 明确按目标 Linux x86_64/CPython 3.11/test extra 计算，不依赖运行该检查的宿主。它检查声明覆盖，不声称替代 pip 的哈希与二进制验证。

使用 uv 0.11.26 对已有输出做原位无升级重编译，除生成命令的输出路径头部外与 head 锁完全一致；从空输出重新解析会得到 17 个更新的旧依赖版本，因此没有宣称空输出重编译逐字相同。这不改变实际 PR 保留旧版本的事实。

对主干的风险

没有阻塞 finding。 独立一次性 Linux x86_64 容器、Python 3.11.17/Node 24.21.0，分别安装 base/head 的真实锁；两边均构建各自源码 wheel、以 wheel 哈希安装、通过 pip check，并在源码目录外确认包来源。Chat 资产依据未变的 frontend source fingerprint 复用并在两边验证，不是伪造安装成功。

base 两个 Stage2C 分片均因 ModuleNotFoundError: PIL 收集中断；head 分片分别完成 129/128 项收集。运行新增锁检查和 public-source-reader 测试 37 passed，包括实际 SVG 像素和透明度验证。分别删除三个新包、把 Pillow 改为不满足范围的 13.0.0，四种变异均被新增检查拒绝；恢复原锁后再次通过。Ruff、差异空白检查通过。两边相同的 Pydantic forward-reference warning 保留。没有执行完整端到端、mutants 或 installed 资格任务，也没有查询、轮询或等待 GitHub CI。

我的整体评价

APPROVE。 本次关闭的是已复现的依赖/收集维护问题；long_horizon 与 user_experience 均改善，现有流程无需手工补装。范围和体量合理，未来重构检查采用同一声明来源的一条测试，不需要抽象提取或另建入口。已检索现有覆盖、完整当前队列的相关 key files 以及同作者最近 12 个 PR；所检范围没有重复锁检查或同形烟测批次。完整 Stage2C 执行仍是未测范围，不能把收集和 37 项聚焦测试写成全套任务通过；评审批准不授予合并权限。

English review

Motivation

The existing Stage2C hashed environment installs successfully but omits declared image test dependencies. Pytest imports the public-source reader before marker selection and fails on PIL. Adding the three dependencies restores discovery without repeated manual installs; the new read-only check catches later declaration drift. This is a test-environment repair, not a production dependency or workflow change.

Approach and changes

Keep pyproject and existing build-tools input as declaration owners and uv as resolver. The whole PR adds153 generated pin/hash lines and a59-line ordinary pytest check; all50 existingpins remain unchanged. The test evaluates target Linux/CPython3.11 markers, canonicalizes package names and checks version constraints. It does not replace hashed binary installation. Specification docs/development/testing-and-quality.md at 5c62c5c03f13cc84176338100f2bded12801530e, criterion Local Validation Environment / 本地验证环境, is implemented by explicit interpreter and real hashed installation/source validation. Seeded no-upgrade uv0.11.26 reconstruction matches except its command-path header; an empty output independently resolves17 newer versions, so fresh-empty-output equality is not claimed.

Risk and validation

Separate Linuxx86_64/Python3.11.17/Node24.21.0 base/head environments install the real binary-only hash locks, build/hash-install their own source wheels, pass pip check and prove package provenance outside the source tree. Unchanged frontend fingerprint is verified before reusing the built asset. Base bothshards fail PIL discovery; head collects129/128 successfully. New lock and public-source image tests37pass, including real SVG pixels/transparency. Three missing-package mutations and incompatible Pillow13 allfail for the expected reasons, then exact lock restorationpasses. Ruff/whitespacepass. The unchanged Pydantic warning is retained. Whole e2e execution, mutants and installed-qualification jobs were not run; GitHub CI was not consulted.

Overall judgment

No blockingfinding. This cohesive maintenance slice restores useful repeated qualification and removes recurring manual install work without new state/options/authority. Existing coverage, related current queue keyfiles and the author's last12 PRs show no duplicate lock-guard batch in the inspected scope. Keep the declaration-driven check; no separate helper/framework is warranted. Approval of this exact head is not merge authority or a claim that the complete unchanged qualification matrix ran.

English verdict: APPROVE - 4215bdafe80c16a38773bc55172ce2473d552146; real Linux hash installation/source-wheel provenance and collection restored,37 focusedtests and4 mutation oraclesverified.