[appergb]

Summary

The staging image could not install the checked-in Python test lock because several newest wheels were unavailable for the image's Python/platform combinations. The failure first surfaced as rpds-py==2026.6.3, but the same image also lacked compatible builds for argon2-cffi-bindings==26.1.0, cffi==2.1.1, pycparser==3.0, and referencing==0.37.0.

This PR keeps the application and encrypted sync protocol unchanged and updates only the test dependency lock to a portable, fully pinned combination:

• argon2-cffi-bindings==21.2.0
• cffi==2.0.0
• pycparser==2.23
• referencing==0.36.2
• rpds-py==0.27.1
• typing-extensions==4.16.0 (now explicitly pinned)

The lock is available for Python 3.9 and 3.14 Linux wheels. CI now runs pip check and adds a Python 3.9/3.14 locked-install matrix covering interop, OpenAPI contract, and unit checks.

Validation

• Python 3.9 and 3.11 venv locked installs and pip check
• CPython 3.9 and 3.14 manylinux x86_64 wheel availability checks
• Python 3.9/3.11 interop, OpenAPI contract, and unit checks
• cargo fmt --check
• cargo clippy --all-targets --locked -- -D warnings
• cargo test --locked
• cargo audit --deny warnings
• cargo build --release --locked
• scripts/smoke_local.py
• Workflow YAML parse

No production service, database, protocol metadata, or runtime code was changed.