ci: restore reproducible green test baseline

[asimons81]

Root cause

The held Dependabot PRs were not breaking CI. A unit test contained a fixed waiver expiry of 2026-07-12T20:00:00Z while waiver creation used the real current clock. After July 12, the test deterministically failed with waiver expiry must be after creation across every test lane and the coverage job.

Fix

• Freeze hardproof.commands.shared.utc_now inside the waiver command test so creation remains one hour before its fixed expiry.
• Add constraints/ci.txt, generated from a green Linux 3.11/3.12, macOS 3.11, and Windows 3.11 matrix.
• Pin pip and apply the same constraint graph to both normal installs and isolated build environments through PIP_CONSTRAINT and PIP_BUILD_CONSTRAINT.
• Use the constrained environment in both ci.yml and the tag-triggered release.yml.
• Print Python, pip, pytest, and the complete frozen environment in CI/release diagnostics.
• Include pyproject.toml and constraints/ci.txt in setup-python cache keys.
• Group routine minor/patch GitHub Actions updates while leaving major updates as individual PRs.

Validation

Final acceptance commit: 3f3566609e8210efe45c3ca9da94d108882cc49b

Passed:

• Ubuntu Python 3.11 full suite
• Ubuntu Python 3.12 full suite
• macOS Python 3.11 full suite
• Windows Python 3.11 full suite
• Ruff
• mypy
• total coverage gate at 90%
• critical-module coverage gate at 95%
• package-data and license contracts
• wheel installation smoke test
• pip-audit
• SBOM/checksum generation
• Codecov upload
• CodeQL

No coverage threshold was reduced and no red check was bypassed.