Compile requirements.lock on the lowest supported Python, and verify it once

The Windows job could never install from this lockfile and the Linux/macOS
jobs could never verify it, for the same underlying reason: pip-compile
resolves version-conditional dependencies for the interpreter it runs on and
emits no markers, so 3.10 and 3.11 produce genuinely different files — 135
lines apart, argon2-cffi-bindings among them.

Which direction matters. A 3.10 resolution is a superset: it carries
async-timeout, which aiohttp requires below 3.11, and installs cleanly under
--require-hashes on 3.11. A 3.11 resolution is missing it, so on 3.10 pip
tries to fetch async-timeout unpinned and --require-hashes refuses — which is
exactly how the Windows job died. So the lockfile is now compiled on 3.10,
the minimum in pyproject's `python = ">=3.10,<3.13"`, and verified to install
on both 3.10 and 3.11.

Verification moves out of the build matrix into its own job pinned to that
same interpreter. Regenerate-and-diff answers "did this file really come from
src/requirements.txt", which is one question about one artifact and wants
asking once, on the interpreter that produced it — not once per matrix entry
on whichever Python that entry happens to use. Every platform still installs
with --require-hashes, which is the part that had to stay everywhere.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

.github/workflows/python-ci.yml

@@ -9,6 +9,39 @@ on:
     - cron: '0 3 * * *'
 
 jobs:
+  # Regenerating the lockfile and diffing it proves the committed file really
+  # came from src/requirements.txt. It has to happen on ONE interpreter, and
+  # specifically on LOCK_PYTHON below, so it cannot ride the build matrix.
+  #
+  # pip-compile resolves version-conditional dependencies for the interpreter
+  # it runs on, and the result carries no markers. Python 3.10 needs
+  # async-timeout (aiohttp requires it below 3.11) and 3.11 does not, so the
+  # two resolutions are genuinely different files -- 135 lines apart,
+  # argon2-cffi-bindings among them. One committed lockfile cannot equal both.
+  #
+  # Compiling on the LOWEST supported version is what makes a single lockfile
+  # work everywhere: 3.10's resolution is a superset, and it installs cleanly
+  # under --require-hashes on 3.11. The reverse does not -- a 3.11 lockfile
+  # is missing async-timeout, so on 3.10 pip tries to fetch it unpinned and
+  # --require-hashes refuses. Both halves of that were failing here: the diff
+  # could never match on one platform, and the install could never succeed on
+  # the other.
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          # Must equal the minimum in pyproject's `python = ">=3.10,<3.13"`.
+          # Raising that floor means regenerating requirements.lock here.
+          python-version: "3.10"
+      - name: Verify the lockfile matches src/requirements.txt
+        run: |
+          python -m pip install --upgrade pip
+          pip install pip-tools
+          pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
+          git diff --exit-code requirements.lock
+
   secret-scan:
     name: Secret Scan
     runs-on: ubuntu-latest
@@ -76,22 +109,6 @@ jobs:
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.lock') }}
           restore-keys: |
             ${{ runner.os }}-pip-
-      # Regenerating the lockfile and diffing it proves the committed file
-      # really came from src/requirements.txt. It can only be done on ONE
-      # interpreter: pip-compile resolves version-conditional dependencies
-      # per Python version, so 3.10 and 3.11 produce genuinely different
-      # files (argon2-cffi-bindings among others), and a single committed
-      # lockfile cannot equal both. Run as written across this matrix the
-      # check was unsatisfiable -- whichever version the lockfile was built
-      # on, the other job failed. Linux/3.11 is the canonical generator, so
-      # the verification lives there.
-      - name: Verify the lockfile matches src/requirements.txt
-        if: runner.os == 'Linux'
-        run: |
-          python -m pip install --upgrade pip
-          pip install pip-tools
-          pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
-          git diff --exit-code requirements.lock
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip