fix(ci): use portable Python test lock

.github/workflows/check.yml

@@ -26,7 +26,8 @@ jobs:
       - run: cargo fmt --check
       - run: cargo clippy --all-targets --locked -- -D warnings
       - run: cargo test --locked
-      - run: python -m pip install -r scripts/requirements-test.lock
+      - run: python -m pip install --requirement scripts/requirements-test.lock
+      - run: python -m pip check
       - run: python scripts/check_contract.py
       - run: python scripts/interop_vectors.py
       - if: runner.os != 'Windows'
@@ -42,6 +43,22 @@ jobs:
         run: |
           cargo install cargo-audit --locked --version 0.22.2
           cargo audit --deny warnings
+  python-lock:
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.9', '3.14']
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install --requirement scripts/requirements-test.lock
+      - run: python -m pip check
+      - run: python scripts/interop_vectors.py
+      - run: python scripts/check_contract.py
+      - run: python -m unittest discover -s tests -p 'test_*.py'
   msrv:
     runs-on: ubuntu-latest
     steps:

README.md

@@ -38,7 +38,8 @@ cargo clippy --all-targets --locked -- -D warnings
 cargo test --locked
 cargo build --release --locked
 python3 -m venv .venv
-.venv/bin/python -m pip install -r scripts/requirements-test.lock
+.venv/bin/python -m pip install --requirement scripts/requirements-test.lock
+.venv/bin/python -m pip check
 .venv/bin/python scripts/interop_vectors.py
 .venv/bin/python scripts/check_contract.py
 .venv/bin/python -m unittest discover -s tests -p 'test_*.py'
@@ -50,6 +51,8 @@ cargo audit --deny warnings
 
 生产没有开发身份后门，运行必须提供与现有 OpenLess 登录一致的 GitHub OAuth 配置。合成身份仅存在于测试中；真实进程测试只向临时数据库注入一次测试会话。默认 restricted 模式，先用指定账号逐项测试。
 
+The test dependency lock is validated on Python 3.9 and 3.14 in CI. Keep the lock file intact when reproducing the staging checks; use `python -m pip check` after installation before running the contract scripts.
+
 ## 开源与许可
 
 Copyright (C) 2026 OpenLess contributors.

scripts/requirements-test.lock

@@ -1,11 +1,12 @@
 argon2-cffi==25.1.0
-argon2-cffi-bindings==26.1.0
+argon2-cffi-bindings==21.2.0
 attrs==26.1.0
-cffi==2.1.1
+cffi==2.0.0
 jsonschema==4.25.1
 jsonschema-specifications==2025.9.1
-pycparser==3.0
+pycparser==2.23
 PyNaCl==1.6.0
 PyYAML==6.0.3
-referencing==0.37.0
-rpds-py==2026.6.3
+referencing==0.36.2
+rpds-py==0.27.1
+typing-extensions==4.16.0