Constrain pysb>=1.17.0 to avoid a broken legacy build path

uv resolves one consistent dependency graph across all declared
extras/groups, even ones not requested for a given sync - so the CI
unit-test job (extras: tests, reports, combine, vis) pulled in pysb via
the unrelated `doc` extra's requirement. The resolver picked pysb 1.16.0,
whose `ez_setup.py` bootstrap tries to download setuptools from a
defunct pypi.python.org URL and fails to build, both locally and on
GitHub Actions runners. pysb>=1.17.0 builds cleanly; constrain the
resolver to it without changing the public dependency ranges declared
in the `tests`/`doc` extras.

Verified: `uv sync --extra tests --extra reports --extra combine --extra
vis --group ci` now resolves and installs successfully, and the full
test suite passes (378 passed, 4 skipped) via the same recipe CI uses.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: dweindl

pyproject.toml

@@ -90,6 +90,11 @@ ci = [
     "benchmark_models_petab @ git+https://github.com/Benchmarking-Initiative/Benchmark-Models-PEtab.git@master#subdirectory=src/python",
 ]
 
+[tool.uv]
+# pysb<1.17 fails to build: its legacy `ez_setup.py` bootstrap downloads
+# setuptools from a defunct pypi.python.org URL.
+constraint-dependencies = ["pysb>=1.17.0"]
+
 [tool.setuptools.packages.find]
 include = ["petab", "petab.*"]
 namespaces = false