ci: generate and validate dependency repair candidates

[ArjiaTechnologies]

Summary

Provides a read-only, source-bound dependency-lock candidate workflow that is self-validating on this same-repository draft PR.

The workflow now:

• replaces the unused full mlflow dependency only inside the runner workspace with mlflow-skinny>=3.15.1,<4
• performs targeted lock regeneration for Cryptography, GitPython, mlflow-skinny, SQLParse, and Twine
• requires the full mlflow distribution to be absent
• runs installed-metadata, Cryptography AES-GCM, isolated SQLite tracking, complete non-ML quality, packaging, installed-wheel, and audit gates
• uploads exact source-bound candidate files and diff for review
• remains read-only with contents: read; it cannot commit, push, merge, release, deploy, or mutate production

Successful source-bound evidence

Run 32161399841, bound to source SHA c559110b7c4f6c8d15168d7765a3f81e91fb7b48, completed successfully without a dependency override.

Its PyPI-only artifact resolved:

• Cryptography 50.0.0
• GitPython 3.1.59
• full MLflow distribution absent
• mlflow-skinny 3.15.1
• SQLParse 0.6.0
• Twine 7.0.0

Every generator gate passed: targeted resolution, exact distribution/version invariants, sync, uv pip check, AES-GCM, SQLite tracking through the skinny-provided mlflow namespace, complete non-ML checks, package/Twine/installed-wheel smoke, Cryptography floor enforcement, and pip-audit with tracking installed.

The reviewed artifact changed only pyproject.toml and uv.lock, used only the expected editable ARES self-source plus PyPI, introduced no package, Git/path dependency, alternate registry, or unexplained upgrade, and removed the unused full-MLflow/server dependency closure. It was applied to draft repair PR #23, whose normal CI is fully green at 67a94f129eb09ad77cc3ca34b190bba263a11958.

Safety

This support PR remains draft and contains only non-production maintenance tooling. It does not include the product dependency repair itself, bypass checks, merge, release, deploy, publish, or change credentials, accounts, production, or branch protection.