fix: keep Dependabot from resolving unsupported Atheris

fuzz/requirements-atheris.in

@@ -1,5 +1,6 @@
 # Atheris coverage-guided job deps. Compile: uv pip compile fuzz/requirements-atheris.in --generate-hashes --python-version 3.12 --universal -o fuzz/requirements-atheris.txt
-# Atheris 3.1.0 has wheels for the Python 3.12 fuzz runner and the central
-# coverage-evidence image; 3.0.0 is no longer available to that image.
+# Atheris 3.1.0 is pinned to the repository's CPython 3.12 fuzz runner. Other
+# interpreters must skip this optional native fuzz dependency until a compatible
+# wheel is available.
 pip
-atheris==3.1.0
+atheris==3.1.0; python_full_version == "3.12.*"

fuzz/requirements-atheris.txt

@@ -1,7 +1,13 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile fuzz/requirements-atheris.in --generate-hashes --python-version 3.12 --universal -o fuzz/requirements-atheris.txt
-atheris==3.1.0 \
+# uv's universal resolver widens the source marker to <3.13; preserve the
+# exact CPython 3.12 boundary so Dependabot on Python 3.10 skips Atheris.
+atheris==3.1.0 ; python_full_version == '3.12.*' \
     --hash=sha256:315a0b5c819852b1ffe1ca72efc389c7724881f2c33e4aacb8c6bcec49bd5011 \
     --hash=sha256:ec5e11f21a4c197fe91f7aea2b2de88e623c73a21fc07b105ac6329a1588457b \
     --hash=sha256:f8a9f51ce8369026e8eb7b7174835e8c4c85a1a6db5d9add36c15100779d2a39
     # via -r fuzz/requirements-atheris.in
+pip==26.2.1 \
+    --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e \
+    --hash=sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f
+    # via -r fuzz/requirements-atheris.in

tests/test_atheris_requirements_marker.py

@@ -0,0 +1,13 @@
+"""Keep the optional native Atheris dependency out of unsupported interpreters."""
+
+from pathlib import Path
+
+
+def test_atheris_lock_keeps_exact_cpython_312_marker() -> None:
+    """The generated lock must not widen the Atheris marker to Python 3.10."""
+    root = Path(__file__).resolve().parents[1]
+    source = (root / "fuzz/requirements-atheris.in").read_text(encoding="utf-8")
+    lock = (root / "fuzz/requirements-atheris.txt").read_text(encoding="utf-8")
+    assert 'python_full_version == "3.12.*"' in source
+    assert "atheris==3.1.0 ; python_full_version == '3.12.*'" in lock
+    assert "atheris==3.1.0 ; python_full_version < '3.13'" not in lock