Fix: run the update-constraints pre-commit hook in check mode

[AmaadMartin]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

Prior art: google#6505 proposes the same
one-line change, bundled with four other edits that have since landed
separately.

2. Or, if no issue exists, describe the change:

Problem: The Pre-commit Linter job fails on every commit to main, while
the other 15 jobs pass. The update-constraints hook runs
./scripts/update_constraints.sh with no flag, which is the script's update
mode. Update mode re-derives --exclude-newer from the current date, rewrites
all five constraints-*.txt headers, and exits non-zero whenever it rewrote a
file. An auto-fixer that exits 1 on success cannot pass as a gate.

Solution: Pass --check in the hook entry. The script's own usage block
already designates --check as the CI mode. Check mode reads the recorded
--exclude-newer date back out of each file header, so it is deterministic and
never writes to a tracked file. It still fails on real pin drift, so the guard
is kept, not deleted.

Two new tests pin the contract: the hook entry must pass --check, and every
Python version in the script's PYTHON_VERSIONS array must have a committed
constraints file.

Deliberately not re-shipped, because they already landed on main: the
astral-sh/setup-uv step in the lint job (566fca3f), the five
constraints-*.txt files and the codespell skip (42f220a6). This PR touches
one YAML file and adds one test module.

Collision check against the open fork PRs. Three PRs edit the same six lines,
and none of them use --check:

• Fix: unbreak the permanently-failing update-constraints pre-commit hook #56 and Fix: remove the broken update-constraints pre-commit hook and the README recipe for unpublished constraints files #110 delete the hook. That turns the job green but drops the pin-drift
  guard.
• Fix: stop running the constraints auto-updater in the lint job #49 sets stages: [manual]. Same loss of the guard. It was written before the
  constraints files were committed and before the lint job had uv, so at the
  time disabling the hook was the only option. Both premises have changed.

Five more PRs (#54, #68, #77, #149, #159) edit
scripts/update_constraints.sh. This PR does not touch that script, so it does
not conflict with them.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

pytest tests/unittests/scripts/test_update_constraints_hook_config.py -q
2 passed

Both tests were proved able to fail, by mutating the exact line each one pins:

Mutation	Failure
Remove --check from the hook entry	AssertionError: The update-constraints hook must pass --check ... / assert '--check' in []
Delete constraints-3.14.txt	AssertionError: No committed constraints file for Python ['3.14'] ...
Delete .pre-commit-config.yaml	FileNotFoundError on the config read

Manual End-to-End (E2E) Tests:

Run from the repo root. Needs uv and network access to PyPI.

uvx pre-commit run update-constraints --all-files
update-constraints.......................................................Passed
git status --porcelain   # empty: the hook rewrote nothing

Both failure paths were exercised the same way:

Injected fault	Result
Downgrade the a2a-sdk pin in constraints-3.12.txt	Failed, exit 1, constraints-3.12.txt is OUT OF DATE! plus the remedy line. The file was left as-is, so check mode wrote nothing.
Delete constraints-3.14.txt	Failed, exit 1, constraints-3.14.txt is missing!

All other hooks pass on the changed files:

uvx pre-commit run --files tests/unittests/scripts/test_update_constraints_hook_config.py .pre-commit-config.yaml
check yaml / fix end of files / trim trailing whitespace / isort / pyink /
addlicense / ADK Compliance Checks / codespell ....................... Passed

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.