Align pytest with score_tooling pin

[Subramanian-K812]

What this PR does

• Transfers testing-utils's declared pytest, pytest-html, pytest-repeat (plus ruff,
  from [project.optional-dependencies]) into a new flat requirements.txt, unpinned.
  pyproject.toml's own dependencies field is untouched.
• Adds compile_pip_requirements (BUILD) with explicit
  srcs = ["requirements.txt", "@score_tooling//python_basics:requirements.txt"], merged as
  peer inputs. A score_tooling bump is picked up by re-running bazel run //:requirements.update
  with no edit anywhere in testing_tools, since our side carries no version of its own to fall
  out of range.
• Adds requirements.txt.lock — a real, hash-pinned lock generated via
  bazel run //:requirements.update.
• Updates .github/workflows/fomat_and_test.yml: both the lint and test jobs now install
  from the same hash-pinned lock (lint previously ran pip install -e ".[dev]" || true —
  unpinned, errors silently swallowed). Neither job installs the package itself;
  pyproject.toml's [tool.pytest] sets pythonpath = ["."], so tests import testing_utils
  without an install step.

Files

File	Change
BUILD	compile_pip_requirements: explicit srcs = ["requirements.txt", "@score_tooling//python_basics:requirements.txt"]; extra_args = ["--no-annotate"] (needed — bazel run vs bazel test embed different runfiles paths in annotations otherwise, breaking the freshness check); tags = ["manual"]
requirements.txt	New — bare, unpinned: pytest, pytest-html, pytest-repeat, ruff
requirements.txt.lock	Generated, hash-pinned lock; carries ruff
pyproject.toml	[tool.pytest.ini_options] → [tool.pytest] (pytest ≥9.0's native section); dependencies unchanged
.github/workflows/fomat_and_test.yml	lint job installs from the lock instead of pip install -e ".[dev]" || true; test job installs only the lock; bazel test //:requirements_test freshness check added

Verification

• bazel run //:requirements.update reproduces requirements.txt.lock byte-for-byte from a
  clean checkout.
• bazel test //:requirements_test passes on the fresh lock and fails on a corrupted one.
• A downstream consumer pinned to pytest==8.4.1 installs testing-utils cleanly with no
  conflict (bare requirements.txt imposes no floor of its own), and our own lock resolves
  pytest==9.0.1, matching score_tooling@1.1.2's exact pin.
• Hash integrity: corrupting a locked package's hash makes pip install refuse with
  THESE PACKAGES DO NOT MATCH THE HASHES....

Known limitations

• Between score_tooling 1.2.0 and 1.3.1, python_basics:requirements.txt was renamed to a
  per-Python-version file. Bumping score_tooling in testing_tools past that boundary will make
  requirements.update fail to analyze — a hard, visible error, not silent drift — until the
  srcs label in BUILD is updated to match.

[PiotrKorkus]

when bazel already resolved deps with score we should install only those so we mimic downstream repos env

[Subramanian-K812]

Dropped the second install — the job now installs only the lock.

[PiotrKorkus]

how is that building metadata from pyproject.toml by providing all python files?

[Subramanian-K812]

only needs the package directories to exist, narrowed to the two init.py markers

[PiotrKorkus]

there is no such argument in documentation, why not src?

[Subramanian-K812]

Switched to srcs — constraints only exists from rules_python 1.5.0, not the 1.4.1 this module pins, so the rules_python bump is reverted too.

[PiotrKorkus]

depreciated, use correct section
https://docs.pytest.org/en/stable/reference/customize.html#pyproject-toml