[BUG]: generate_lockfiles.sh passes pip-compile arguments in wrong order

[rederik76]

Summary

scripts/generate_lockfiles.sh builds pip-compile arguments in an order that can break lockfile regeneration. Input file, --generate-hashes, and optional --allow-unsafe (for requirements-dev.txt) should be grouped and passed before --output-file and --no-emit-index-url.

Current behavior

The script spreads extra_args between the requirements file and trailing flags:

pip-compile \
    "$REPO_ROOT/$req_file" \
    --generate-hashes \
    "${extra_args[@]}" \
    --output-file "$REPO_ROOT/$lock_file" \
    --no-emit-index-url

This can cause pip-compile to mis-parse options when regenerating hashed lockfiles, especially for requirements-dev.txt where --allow-unsafe is required to pin setuptools on Python 3.12+.

Expected behavior

All compile-time options (input file, hashes, unsafe packages) are passed in a single argument group before output flags:

compile_args=(
    "$REPO_ROOT/$req_file"
    --generate-hashes
)
# ... optional --allow-unsafe for requirements-dev.txt ...
pip-compile \
    "${compile_args[@]}" \
    --output-file "$REPO_ROOT/$lock_file" \
    --no-emit-index-url

Steps to reproduce

1. From repo root, with pip-tools installed: ./scripts/generate_lockfiles.sh
2. Observe failures or unexpected lockfile output when compiling requirements-dev.txt (depending on pip-compile version).