fix: unpin runpod-flash to released 1.19.0

[deanq]

Problem

The scheduled Bump Runtime Dependencies workflow has been failing since 2026-07-24 (latest run):

× Failed to download and build `runpod-flash @
  git+https://github.com/runpod/flash.git@deanquinanola/sls-360-local-module-bundling`
╰─▶ fatal: couldn't find remote ref
    refs/tags/deanquinanola/sls-360-local-module-bundling

a44da63 (SLS-360) pinned runpod-flash to a flash feature branch as an explicitly temporary measure, because the worker imports runpod_flash.runtime.module_loader which had no published release. That branch was deleted when runpod/flash#352 merged on 2026-07-20, leaving a dangling ref.

This breaks any clean uv lock / uv sync on main, not just the bump workflow.

Fix

runpod-flash 1.19.0 (released 2026-07-28, contains runpod/flash#352) is the first release shipping runpod_flash/runtime/module_loader.py, so the pin is replaced with the released constraint the original TODO called for.

• pyproject.toml: git ref -> runpod-flash>=1.19.0
• uv.lock: runpod-flash 1.18.0 (git) -> 1.19.0 (registry)
• uv.lock: runpod 1.10.2.dev1 (runpod-python git main) -> 1.10.1 (registry)

Note on the runpod change

The flash branch pin was transitively dragging in runpod from runpod-python git main (an unpinned moving target). Dropping the flash git dep drops that too, so runpod now resolves from PyPI. This is intended — the worker should not ship a dependency on another repo's main — but it is a real change in what gets installed, and 1.10.1 is nominally lower than the 1.10.2.dev1 snapshot it replaces.

It does not go to 1.11.0 (current PyPI latest) because --upgrade-package only unpins the named package, and 1.11.0 requires newer pinned boto3/fastapi/click, so uv backtracks. The lock was generated with the bump workflow's own command, so the next scheduled run produces no further diff.

Test plan

• uv lock --upgrade-package runpod-flash --upgrade-package runpod — the failing command — now succeeds
• module_loader.py confirmed present in the published 1.19.0 wheel
• from runpod_flash.runtime.module_loader import * imports against installed 1.19.0
• make quality-check: 283 passed, coverage 81.52% (threshold 35%), ruff + mypy clean
• make test-handler: 14/14 passed
• Confirm the next Bump Runtime Dependencies run goes green after merge

Follow-up

A CI guard rejecting git+ dependencies in pyproject.toml on main would prevent recurrence — a branch pin both silently defeats the version-bumping workflow and hard-fails once the branch is deleted. Proposed as a separate PR.