build(review): add hash-pinned coverage lock for account-unification

[seonghobae]

Summary

The central OpenCode coverage-evidence job runs services/account_unification's pytest suite inside a networkless sandbox that installs project dependencies only from a base-branch requirements.lock / requirements-hashes.txt (see materialize_base_python_requirements.py in ContextualWisdomLab/.github; a deliberate supply-chain trust boundary — PR-head manifests are never resolved). keyverse shipped only uv.lock, so the sandbox could not import pydantic/fastapi → coverage-evidence fails → OpenCode publishes REQUEST_CHANGES for "missing test/coverage evidence" on every account-unification PR (e.g. #33).

This adds the missing hash-pinned lock on the default branch so open and future account-unification PRs inherit a runnable coverage sandbox.

What this file is

services/account_unification/requirements.lock — the runtime imports needed to collect and run tests/ (fastapi, pydantic, httpx, pyyaml) plus their fully-resolved transitive closure, hash-pinned.

• Compiled for the sandbox interpreter: python:3.14-slim, x86_64-manylinux_2_28, wheels only (--only-binary :all:), matching the sandbox's --require-hashes --only-binary=:all: install.
• Disjoint from the sandbox's pinned test toolchain (pytest/coverage/interrogate) — zero shared package names, so it cannot disturb the toolchain.
• Separate from uv.lock, which stays authoritative for local/CI uv sync --locked. The file's header documents its purpose and the exact regeneration command.

Verification

• All 52 account-unification tests pass in a clean venv with exactly this runtime set (fastapi + pydantic + httpx + pyyaml + toolchain).
• uv pip compile resolved the full transitive closure (15 packages) for the target platform with --generate-hashes --only-binary :all:.
• This change is lock-only (no *.py), so the Python coverage path is not-applicable → coverage-evidence passes on this PR itself.

Notes

Unblocks #33 (which stays blocked on this exact evidence gap) once merged; #33 then re-runs coverage-evidence against a base that can install its dependencies. Complements — does not conflict with — the central .github#612 approach; this scopes the fix to keyverse and does not depend on that stalled PR.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• services/account_unification/requirements.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 566a2f17-94d3-43db-bf4a-3887b0f2617f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}