fix(showcase): lock the AG2 showcase's Python dependencies - #8389

Fixes #7285

The AG2 showcase now installs an exact, locked set of Python packages, so rebuilding the same commit gives the same environment.

Thanks @contextablemark for a really clear issue. The acceptance criteria, and especially the call to check that two clean builds produce the same package inventory, shaped how this was verified.

What changed

The five top-level requirements now live in showcase/integrations/ag2/requirements.in. The ranges are the same as before, and so is the ag2[openai,ag-ui,mcp]==1.1.2 pin.

requirements.txt is now generated from it with uv pip compile --universal. Every package is pinned with ==, including everything that comes in through ag2's extras. It covers Python 3.10 and up, so the CI jobs that install this file get the locked versions without any change on their side. The Compatibility source check still reads ag2 as an exact 1.1.2 pin.

requirements.lock is generated from requirements.txt with hashes, for Python 3.12 on linux/x86_64 to match the python:3.12.13 base image. The Dockerfile installs it with --require-hashes. The image build installs exactly these files and stops if anything is missing a pin or a hash. Because it is built from the exact pins, the two files always agree on versions.

The issue was written before #7767 moved AG2 to 1.1.2, so this locks the 1.1.2 set rather than a pre-1.0 one. openai and ag-ui-protocol are no longer top-level lines. They are pinned through the lock now (openai 3.49.0, ag-ui-protocol 1.0.0).

To update a dependency, edit requirements.in and run the two commands in its header. Both generated files also show the full command at the top.

Verification

Two docker build --no-cache runs of the agent-builder stage on linux/amd64 produced identical pip freeze output. It matches the lock exactly (41 packages). The ag2 Python tests pass on 3.10 and 3.12 using the same install command CI uses (20 passed on each). validate-pins reports the same results as before. Editing the ag2 hashes in the lock makes the image install fail with a hash mismatch.

Happy to change the shape if you'd rather go with a uv.lock and uv sync --locked. That would mean changing the CI install steps too, so it felt like a bigger step for one integration. A small check that keeps requirements.lock in sync with requirements.txt could be a nice follow-up.

Checklist

• Declared ranges and the ag2 pin unchanged
• Image installs with --require-hashes
• Two clean builds produce the same package inventory
• ag2 Python tests pass on 3.10 and 3.12
• validate-pins unchanged
• Shared Showcase probes