feat: Dockerfile + constraints.txt for deterministic deps

.github/workflows/sync-cloud-run-env.yml

@@ -219,6 +219,11 @@ jobs:
           project_id: ${{ env.GCP_PROJECT_ID }}
           version: ">= 416.0.0"
 
+      - name: 
+      - name: Download constraints
+        if: steps.config.outputs.deploy_enabled == 'true'
+        run: curl -sL https://raw.githubusercontent.com/QuantStrategyLab/QuantPlatformKit/main/constraints.txt -o constraints.txt
+
       - name: Build, push, and deploy Cloud Run image
         if: steps.deploy_config.outputs.enabled == 'true'
         run: |

Dockerfile

@@ -11,8 +11,9 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 COPY requirements.txt ./
+COPY constraints.txt ./
 RUN python -m pip install --upgrade pip \
-    && python -m pip install -r requirements.txt \
+    && python -m pip install -r requirements.txt -c constraints.txt \
     && apt-get purge -y git \
     && apt-get autoremove -y --purge \
     && rm -rf /var/lib/apt/lists/*

constraints.txt

@@ -0,0 +1,14 @@
+# QSL Dependency Constraints — SINGLE SOURCE OF TRUTH
+# All repos MUST reference this file for git-based dependency SHAs.
+# Generated: 2026-07-01
+# Auto-updated by update-qpk-pin.yml on every push to QPK main.
+
+quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@a9085d6d46147f62b80bbd441d19d85acaa3dda6
+us-equity-strategies @ git+https://github.com/QuantStrategyLab/UsEquityStrategies.git@635f64207a9db8dc7af51e7ad496557a57be5579
+hk-equity-strategies @ git+https://github.com/QuantStrategyLab/HkEquityStrategies.git@5fb48ea102c28deb6dd1c9674553f3c77aba4f2c
+cn-equity-strategies @ git+https://github.com/QuantStrategyLab/CnEquityStrategies.git@e09fd557c2bd9ae5f4d44228915c4e52c4b0dd21
+crypto-strategies @ git+https://github.com/QuantStrategyLab/CryptoStrategies.git@565be005e4186fd6d750884e7b0bc59f779f9549
+quantuscombostrategies @ git+https://github.com/QuantStrategyLab/QuantUsComboStrategies.git@d35f4f86b09a7f4e99a1f83c973b21f2420398ef
+quanthkcombostrategies @ git+https://github.com/QuantStrategyLab/QuantHkComboStrategies.git@dfc21e923c0f9ba54678a75d0edc96a56e2188e2
+quantcncombostrategies @ git+https://github.com/QuantStrategyLab/QuantCnComboStrategies.git@1172e77e8046088c2bab2880343786ec135539da
+quantcryptocombostrategies @ git+https://github.com/QuantStrategyLab/QuantCryptoComboStrategies.git@475c5259d3ba7e2dcd4de30aaa96437142669a1c