Improve our dependency pinning #4494
Description
Some thoughts from a quick investigation of #4493:
- We wanted to pin our dependencies, and mostly succeed at that. If we had fully succeeded, this would be a non-issue because our CI could only break when we commit a new lockfile, rather than when a broken upstream is released.
- The specific places we fail is when doing a
pip install ".[whatever]"inhypothesis-python/scripts/*-test.sh.- The proper fix is to add
-c requirements/contstraints.txt, with a not-yet-existing union-of-everything constraints lockfile. We'll need to create this, and also pass it as an input to our other lockfile creation commands. (bonus: also replaces all the grepping!) - We should probably also switch to
uv pip, for speed
- The proper fix is to add