test: provision pip in fresh uv environments

[seonghobae]

What

Add the exact trusted pip==26.2.1 pin already present in requirements-pip-audit-ci-hashes.txt to the project dev dependency group.

Why

tests/test_materialize_base_python_requirements.py::test_materialized_bounded_include_is_resolvable_by_pip deliberately runs sys.executable -m pip. A fresh uv run environment did not contain pip, so the repository test contract failed before it could verify the materialized hash closure.

TDD evidence

• Before: fresh uv environment failed with No module named pip.
• After: a second fresh uv environment installed 14 dev packages and the exact test passed.
• Full suite: 1,393 passed, 1 skipped, 16 subtests passed.
• Coverage: 8,346 statements and 3,214 branches at 100%.
• Docstrings: 100%.
• compileall and git diff --check: pass.

Boundary

This does not execute PR-owned locks and does not change #1233 PEP517 build-hook hardening. It only satisfies the existing test interpreter contract with the already trusted pip pin.

---

Summary by CodeRabbit

• Chores
  • 개발 환경의 패키지 설치 안정성을 위해 pip 버전을 지정했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a06b4471-e640-47d2-9807-f5949e965425

📥 Commits

Reviewing files that changed from the base of the PR and between 885f2cd and 73b674b.

📒 Files selected for processing (1)

• pyproject.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

개발 의존성 목록에 pip==26.2.1이 추가되었습니다.

Changes

개발 의존성 업데이트

Layer / File(s)	Summary
pip 버전 고정 pyproject.toml	개발 의존성 목록에 pip==26.2.1을 추가했습니다.

Estimated code review effort: 1 (매우 단순) | ~2분

Merge Risk: ⚪ Minimal · up to 73b67

This change adds the trusted pip pin to fresh development environments so the existing test contract can run; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 새로운 uv 환경에 pip를 설치하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/fresh-uv-pip-test-contract

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[seonghobae]

@opencode-agent @cwl-noema-review current-head review for 73b674b31f80473d49c067ec339a9c561bbbb844.

Pins trusted pip==26.2.1 into the project dev group so fresh uv run environments can execute sys.executable -m pip in the materialized-lock contract. Current-head Strix already PASS. Independent current-head approval is required.

[seonghobae]

@opencode-agent @cwl-noema-review current-head review for 73b674b31f80473d49c067ec339a9c561bbbb844.

Mechanical Checks are green aside from cancelled scan-pr-queue; required Strix already PASS. Independent current-head approval is the remaining merge gate.

[seonghobae]

@opencode-agent @cwl-noema-review current-head review for d4d4c2b0589065976e4bdcf5c5ae429bc21ed680.

Normal merge of protected main after #1252. Independent current-head OpenCode APPROVE is required; old checks on 73b674b3 are not merge evidence.

[seonghobae]

@opencode-agent @cwl-noema-review current-head review for d4d4c2b0589065976e4bdcf5c5ae429bc21ed680.

GitHub CLEAN, hosted Checks green, pyproject.toml thread resolved. Independent current-head OpenCode APPROVE is the remaining merge gate. Do not treat CLEAN as merge authorization.