fix(ci): defer stale base-lock pins when the index is reachable

[seonghobae]

Problem

The central coverage-evidence sandbox currently turns an unavailable trusted-base dependency pin into a repository-wide review deadlock, even when the package index is reachable and offers newer versions.

Live evidence from ContextualWisdomLab/newsdom-api#467 at head 4ba5e81d8dba98fc97ba2f6964751cc958b58c9e:

• every repository-owned test, quality, security, container, and fuzz workflow succeeded;
• central coverage materialization used the protected base commit and attempted to install pypdf==6.13.3;
• the configured reachable index no longer offered that pin;
• coverage-evidence failed before PR-head tests ran, so OpenCode submitted REQUEST_CHANGES and the protected queue could not self-heal through the dependency-upgrade PR.

Change

• classify only the explicit pip diagnostic Could not find a version ... (from versions: <non-empty list>) as a deferable trusted-base preflight failure;
• require at least one concrete alphanumeric version after optional whitespace;
• retain the warning and bounded resolver output;
• let the later networkless coverage run prove whether the skipped base lock was actually required;
• keep (from versions: none), a blank version list, registry/transport failures, hash mismatches, empty diagnostics, and unknown resolver failures fatal.

TDD evidence

1. Added the first regression contract at head 174a76cb52cc5aab06524ce8265794e7f2f6815d.
2. Observed the current classifier return (False, False) for the reachable-index and none counterexamples, so the reachable-index test failed for the intended missing behavior while the fail-closed control passed.
3. Added the minimal classifier pattern and observed (True, False).
4. Added a blank-list counterexample and observed that the first pattern incorrectly returned True.
5. Tightened the pattern to require affirmative version-list evidence and observed (True, False, False) for concrete, none, and blank lists.
6. Replaced helper-only assertions with end-to-end install_materialized_locks tests that prove the concrete list produces a visible skip and both non-evidence shapes abort the trusted build.

Safety boundary

This changes provisioning classification, not coverage verdicts. A missing base pin may be skipped only when pip proves the index was reachable by listing at least one offered version. PR-head tests still run in the networkless sandbox and fail if the dependency was genuinely required.

Scope

Changed files:

• scripts/ci/install_base_python_locks.py
• tests/test_install_base_python_lock_missing_pin.py

This clean PR supersedes only the relevant classifier portion of #674. The unrelated model-budget, CodeQL, requirements-lock, and materializer changes accumulated on #674 are intentionally excluded and remain independently reviewable.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 21 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c5b8ba1-9a21-490b-9c02-8ee0d4735a53

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 2133b5e.

📒 Files selected for processing (2)

• scripts/ci/install_base_python_locks.py
• tests/test_install_base_python_lock_missing_pin.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review exact head 4aa69060358b5af6c2f4e33652036527a08e0f87. Verify the TDD counterexamples, the reachable-index/non-empty-version classifier boundary, (from versions: none) fail-closed behavior, bounded diagnostics, existing base-lock integration path, 100% coverage/docstrings, and current-head security checks. Approve only if no blocking finding remains.

[seonghobae]

@opencode-agent Please review exact head 2133b5e1725124e3f9b233b59559f5a3be5d5564. Verify the end-to-end TDD cases, concrete/none/blank version-list boundary, bounded diagnostics, unchanged fatal handling for transport/hash/unknown failures, 100% coverage/docstrings, and current-head security checks. Approve only if no blocking finding remains.

[seonghobae]

Temporarily closing to respect dependency order and reduce the saturated Actions queue. This focused branch is preserved, but its current-head repository suite still inherits the existing CodeQL-version contract failure from main; #728 must merge first. After #728 lands, this PR will be reopened or replayed on the new main, exact-head checks rerun, and independent approval obtained before merge. No code or TDD evidence is discarded.