fix(deps, pyamber): bind requirement constraints

[anthonychengit]

What changes were proposed in this PR?

Make amber/requirements.txt a constraint for every later operator/dev dependency installation in CI, benchmarks, and computing-unit images. Align its typing_extensions pin with the already-recorded 4.16.0 binary manifest, and add a repository-level regression audit.

Before	After
Later install pass may silently replace a runtime pin	Every later pass resolves under the runtime constraints

Any related issues, documentation, discussions?

Closes #8354

How was this PR tested?

The new audit initially reported the mismatched pin and 11 unconstrained installs. Both suites now pass:

python -m unittest bin.licensing.test_python_requirement_constraints -v
python -m unittest bin.licensing.test_check_binary_deps -v

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Codex was used for implementation and verification assistance. I reviewed the final code and test output before submission.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @aglinxinyuan, @bobbai00
  You can notify them by mentioning @aglinxinyuan, @bobbai00 in a comment.

[github-actions]

Backport auto-label report

This fix: PR was checked against each actively-supported release branch. A release/* label nominates a backport target; the branch's release manager approving this PR is what sends the fix there. The required Backport Approvals check stays red until every label below is approved, so each manager either approves or removes their own label — which is why the labels left on a merged PR are exactly the branches it reached.

Release branch	Analysis
✅ release/v1.3	Change detected on this branch — label added; this fix is queued to backport here. @mengw15 decides: approving sends the fix here, removing this label declines it. The merge waits on one or the other. Review requested.
✅ release/v1.2	Change detected on this branch — label added; this fix is queued to backport here. @xuang7 decides: approving sends the fix here, removing this label declines it. The merge waits on one or the other. Review requested.

Auto-label run.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.88%. Comparing base (7190a81) to head (8910911).

Additional details and impacted files

@@             Coverage Diff             @@
##               main    #8532     +/-   ##
===========================================
  Coverage     95.88%   95.88%             
- Complexity      459      514     +55     
===========================================
  Files           588      588             
  Lines         33802    36853   +3051     
  Branches       4217     4979    +762     
===========================================
+ Hits          32411    35337   +2926     
- Misses          813      891     +78     
- Partials        578      625     +47     

Flag	Coverage Δ		*Carryforward flag
access-control-service	83.22% <ø> (+3.04%)	⬆️
agent-service	99.32% <ø> (ø)
amber	90.87% <ø> (+0.05%)	⬆️
computing-unit-managing-service	76.22% <ø> (-0.93%)	⬇️
config-service	89.25% <ø> (+2.12%)	⬆️
file-service	83.65% <ø> (ø)		Carriedforward from 7190a81
frontend	96.82% <ø> (+0.12%)	⬆️
notebook-migration-service	85.13% <ø> (+1.40%)	⬆️
pyamber	98.47% <ø> (+0.06%)	⬆️
workflow-compiling-service	73.93% <ø> (-0.17%)	⬇️

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Benchmark changes need a look

🟢 2 better · 🔴 3 worse · ⚪ 10 noise (<±5%) · 0 without baseline

Compared against main 7190a81 benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	487	0.297	19,356/30,838/30,838 us	🔴 +22.0% / 🔴 +109.9%
⚪	bs=100 sw=10 sl=64	1,188	0.725	82,466/113,379/113,379 us	⚪ within ±5% / 🔴 +14.0%
🟢	bs=1000 sw=10 sl=64	1,424	0.869	702,289/760,852/760,852 us	🟢 -5.9% / 🟢 +26.4%

Baseline details

Latest main 7190a81 from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	487 tuples/sec	559 tuples/sec	838.23 tuples/sec	-12.9%	-41.9%
bs=10 sw=10 sl=64	MB/s	0.297 MB/s	0.341 MB/s	0.512 MB/s	-12.9%	-41.9%
bs=10 sw=10 sl=64	p50	19,356 us	15,868 us	11,878 us	+22.0%	+63.0%
bs=10 sw=10 sl=64	p95	30,838 us	29,460 us	14,690 us	+4.7%	+109.9%
bs=10 sw=10 sl=64	p99	30,838 us	29,460 us	18,483 us	+4.7%	+66.8%
bs=100 sw=10 sl=64	throughput	1,188 tuples/sec	1,220 tuples/sec	1,095 tuples/sec	-2.6%	+8.5%
bs=100 sw=10 sl=64	MB/s	0.725 MB/s	0.744 MB/s	0.668 MB/s	-2.6%	+8.5%
bs=100 sw=10 sl=64	p50	82,466 us	80,868 us	92,901 us	+2.0%	-11.2%
bs=100 sw=10 sl=64	p95	113,379 us	108,405 us	99,480 us	+4.6%	+14.0%
bs=100 sw=10 sl=64	p99	113,379 us	108,405 us	112,580 us	+4.6%	+0.7%
bs=1000 sw=10 sl=64	throughput	1,424 tuples/sec	1,432 tuples/sec	1,126 tuples/sec	-0.6%	+26.4%
bs=1000 sw=10 sl=64	MB/s	0.869 MB/s	0.874 MB/s	0.687 MB/s	-0.6%	+26.4%
bs=1000 sw=10 sl=64	p50	702,289 us	694,935 us	912,010 us	+1.1%	-23.0%
bs=1000 sw=10 sl=64	p95	760,852 us	808,873 us	950,922 us	-5.9%	-20.0%
bs=1000 sw=10 sl=64	p99	760,852 us	808,873 us	983,333 us	-5.9%	-22.6%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,410.95,200,128000,487,0.297,19356.39,30838.21,30838.21
1,100,10,64,20,1684.12,2000,1280000,1188,0.725,82465.80,113379.18,113379.18
2,1000,10,64,20,14045.55,20000,12800000,1424,0.869,702289.00,760851.51,760851.51

[anthonychengit]

/request-review

CI note: the main-branch Amber and file-service failures are the repository-wide MinIO image outage (minio/minio:RELEASE.2025-02-28T09-55-16Z returns HTTP 404). The auto-added release labels also run this main-targeted dependency fix against older manifests that still record typing-extensions==4.14.1; those labels should be removed unless maintainers want a branch-specific manifest refresh. The main-branch Python constraint and licensing tests pass as documented above.

[github-actions]

Please specify at least one reviewer: /request-review @user.
Check the suggestion comment on this PR for candidates.