build: fix protobuf gencode vs. runtime version conflict

[mojomex]

This PR updates sync_tooling_msgs to a version that locks the build-time protobuf dependency to 6.33.5 and the runtime version to >=6.33.5,<7 to avoid protobuf gencode vs runtime version conflicts.

See Protobuf Docs: Cross-Version Runtime Guarantee for details on allowed version combinations. Most relevant:

New Gencode + Old Runtime = Never Allowed

So, ensure that build-system.requires contains protobuf==6.33.5 and runtime (normal dependencies) contains protobuf>= that.

Within a single major runtime version, generated code from an older version of protoc will run on a newer runtime.

So, limit runtime deps to protobuf<7, resulting in a combined protobuf>=6.33.5,<7.

Corresponding sync_tooling_msgs PR:

• build: fix protobuf gencode runtime version conflict sync_tooling_msgs#4

[mojomex]

@Owen-Liuyuxuan Could I have your opinion on this approach? It's the simplest one I found that passes CI, and guarantees correct versions in the sync_tooling_msgs pyproject.toml, which I think is cleanest.

[Owen-Liuyuxuan]

@mojomex Does it work? I saw there are 6.33.5 in build system and 6.33.6 in the uv lock.

[mojomex]

@Owen-Liuyuxuan I don't have time to try in Pilot Auto CI 🙇 , but CI here succeeds.

6.33.4 has a security vulnerability, so I moved everything to 6.33.5 instead. See https://github.com/tier4/sync_tooling/security/dependabot/15

[Owen-Liuyuxuan]

@mojomex
Moving to 6.33.5 is fine, but I saw the uv.lock which looks like 6.33.6. Please make sure what version we are locked on.

[Owen-Liuyuxuan]

@mojomex I got it, so the run time is running with 6.33.6 and the gencode is 6.33.5 now. In this case it is working. Thank you.

https://protobuf.dev/support/cross-version-runtime-guarantee/ cc: @KYabuuchi taught me that runtime > gencode is OK

[mojomex]

Thank you @Owen-Liuyuxuan for approving, and @KYabuuchi for the evaluator build 🥇

I'll await the results from it, and if OK, merge and create a new version. Thank you for your patience.

[KYabuuchi]

Some ECUs are still running in the build jobs, but three out of five ECUs have succeeded in building the sync_tooling.
Therefore, this PR should be fine 👍

Build Job Link

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud