fix(deps): repair Python 3.14 backend lock and revert conflicting Strix pins (PR 1391)

[seonghobae]

Description

Follow-up for Dependabot #1391. The ci-python group bump failed Python 3.14 at Install backend dependencies for the same hash-lock reasons as #1390, and the Strix compile was not installable:

• Backend lock: pydantic==2.13.4 vs floated pydantic-core==2.48.0, missing hashed httpx2 for openai==3.0.0, and unconstrained compile pulling ruff==0.16.3 / langsmith>=0.10.18.
• Strix lock: strix-agent==1.5.3 requires cryptography>=48,<49, which conflicts with the reviewed cryptography==50.0.0. google-cloud-aiplatform==1.164.0 still requires protobuf<7, so Dependabot’s protobuf==7.35.1 Strix pin was also uninstallable.

This commit (e20c47fc) is also pushed to dependabot/pip/ci-python-3d04c64bfd so #1391 can go green without a squash or empty requeue.

Changes:

• Reuses the Python 3.14-installable backend hash lock and compile constraints from the chore(deps): bump the backend-python group across 1 directory with 56 updates #1390 repair.
• Reverts Strix to the reviewed set: strix-agent==1.0.4, google-cloud-aiplatform==1.160.0, protobuf==6.33.6, cryptography==50.0.0.
• Keeps the remaining ci-python bumps that are compatible (connector websockets==17.0.1, Bandit setuptools==84.0.0).

strix-agent==1.5.3 is not shippable while cryptography must stay on 50.0.0. Does not bump VERSION. Does not touch #1376 or #1392.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Verification

python -m pip install --require-hashes -r backend/requirements-hashes.txt
cd backend
PYTHONWARNINGS=error DISABLE_BACKGROUND_WORKERS=1 python -m pytest \
  tests/test_container_dependency_pin_contract.py \
  tests/test_release_governance.py -q

Local Python 3.14.7 evidence: pin/governance tests 37 passed. Same backend lock as #1390, which also ran the full suite 1732 passed, 32 skipped.

Remaining blocker if CI still fails: a future strix-agent that accepts cryptography==50.0.0. Do not reintroduce strix-agent==1.5.3 until that constraint is gone.

PR 1391 pin contract tests

  

[github-actions]

PR governance metadata gate is not ready for e20c47fcd5f47be96d09bb80b7930d3a5dd94acc:

• Draft PR: merge automation is paused.
• Required check security is FAILURE on the current head.
• Required check Analyze (python) is FAILURE on the current head.
• Required check Analyze (javascript-typescript) is FAILURE on the current head.

[seonghobae]

중복 repair lane 정리: 현재 Dependabot #1391 head 08226072060ec9a55836d4897764b21daaf71b6f가 이 repair head e20c47fcd5f47be96d09bb80b7930d3a5dd94acc를 직접 ancestor로 포함합니다. Python 3.14 hash lock과 Strix pin repair는 canonical Dependabot branch에 보존되었으므로 별도 repair PR은 superseded로 종료합니다. #1391의 exact-current-head 검증과 보호 규칙은 별도입니다.