fix(review): 사주 CalDAV 오프라인 Python 의존성 추가

[seonghobae]

자동 리뷰 증거 계약

• adversarial_validation의 각 probe는 구조화된 path와 양의 line, evidence의 정확한 path:line을 서로 같게 작성해야 합니다.
• source-line-sha256 receipt는 그 동일한 current-head 줄에 결합되어야 합니다.

요약

• OpenCode coverage-evidence의 신뢰된 기본 브랜치 이미지에 사주 CalDAV 테스트용 wheel 의존성 5개를 정확한 버전과 해시로 추가합니다.
• bcrypt, FastAPI, HTTPX, iCalendar, 한국 음력 변환의 전이 의존성을 포함해 총 34개 패키지를 --require-hashes 및 --only-binary 계약으로 설치합니다.
• lunar-python 1.4.8은 공식 배포가 sdist뿐이어서 중앙 네트워크 격리 이미지에 넣지 않고, 대상 저장소가 검증한 소스를 MIT 고지와 함께 벤더링합니다.
• PR 제어 requirements는 계속 실행하지 않으며 coverage 실행 단계는 --network=none을 유지합니다.
• 새로 공개된 pyasn1 서비스 거부 취약점 두 건을 수정한 정확히 0.6.4를 Strix 입력에 고정하고, 공식 배포 해시로 잠금 파일을 갱신합니다.

실패 근거

• 기존 OpenCode run 29685953768의 coverage-evidence job 88190132868은 대상 테스트 수집 중 fastapi, korean_lunar_calendar, icalendar, bcrypt, lunar_python import 누락만으로 실패했습니다.
• Python Security run 29878240773은 Strix 잠금의 pyasn1 0.6.3에서 CVE-2026-59885와 CVE-2026-59886을 검출했습니다.

검증

• 중앙 저장소: 639 passed
• 새 잠금 계약 및 설치 정책 집중 테스트: 12 passed
• pip-audit 2.10.1: No known vulnerabilities found
• 중앙 Dockerfile과 새 해시 잠금으로 Linux 이미지 빌드 성공
• 최신 대상 헤드 96fa833을 --network=none 격리 컨테이너에서 실행: 41 passed
• 대상 CI test, container, CodeQL, Semgrep, OSV, Trivy, Strix 모두 성공

Closes #593
Unblocks ContextualWisdomLab/saju-caldav#6

[Copilot]

Pull request overview

This PR extends the trusted, offline OpenCode coverage-evidence Python environment by adding a hash-pinned runtime dependency set needed to run ContextualWisdomLab/saju-caldav tests in a --network=none sandbox, while keeping the existing “install from trusted lock only” discipline.

Changes:

• Added a new contract test to ensure the newly trusted saju-caldav runtime dependencies are present as exact pins in the source requirements and are hash-locked in the generated lock file.
• Appended the required runtime dependency pins (bcrypt/FastAPI/HTTPX/iCalendar/korean-lunar-calendar) to requirements-opencode-review-ci.txt.
• Regenerated requirements-opencode-review-ci-hashes.txt with uv to include hashes for the expanded dependency closure.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/test_opencode_python_dependency_lock.py	Adds a contract test enforcing that specific saju-caldav runtime pins are present and hash-locked (and that lunar-python is not).
requirements-opencode-review-ci.txt	Adds the trusted runtime pins required for offline saju-caldav test collection/execution.
requirements-opencode-review-ci-hashes.txt	Regenerated uv lock with hashes for the expanded trusted dependency set.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[seonghobae]

Superseded by the consolidated #604 branch, whose stated integration scope includes this PR’s saju-caldav offline coverage dependency lock, pyasn1 security pin, and associated contract tests together with the current evidence-boundary changes. Closing this older component branch to keep one conflict-resolution and review path.