[2/5] Observe locked SDK baselines accurately

[ebarti]

Summary

• treat uv.lock as the authoritative SDK baseline during explicit candidate inspection
• isolate locked baselines when the matching SDK is absent or the ambient environment has drifted
• keep non-opt-in runs honest by recording the actual ambient version instead of stamping it as locked
• convert isolated API snapshot setup, install, execution, timeout, and malformed-output failures into bounded evidence

Stack

• Depends on [1/5] Plan SDK evolution demo reliability repairs #51
• This is layer 2 of 5 in the SDK evolution demo reliability stack

Review boundary

This layer repairs baseline provenance and snapshot collection only. Behavior-probe subprocess failures and the final fail > incomplete > changed > pass assessment are intentionally implemented together in the next layer so incomplete evidence cannot temporarily appear green.

Validation

• PYTHONPATH=. .venv/bin/python -m pytest -q — 421 passed, 12 skipped
• .venv/bin/ruff check .
• .venv/bin/mypy
• uv lock --check
• git diff --check