fix(studio): make scheduler requirements compatible with VeFaaS uv

[zyn080302]

Summary

• replace relative --find-links and nested -r directives with SHA-256-pinned direct local wheel references
• validate the exact stdin requirements contract with offline Linux/x86_64 uv pip install --dry-run
• flatten the offline wheelhouse into the Scheduler function root while preserving pre-wheelhouse package compatibility
• add regressions for the VeFaaS parser failure plus empty, duplicate-distribution, and unsafe-prefix boundaries

Root cause

VeFaaS dependency installation parses requirements.txt from stdin. In that mode, uv rejects --find-links ./wheelhouse as a relative URL without a base. The previous Release Server gate rewrote the path to an absolute file URI, so it did not exercise the production parser contract.

Verification

• focused publisher/Scheduler tests: 18 passed
• related release/self-update/offline/Scheduler suite: 196 passed
• fresh full Bundle on current main: 232,239,512 bytes, 186 wheels
• full Bundle requirements: exact offline uv stdin dry-run passed
• current Scheduler flat staging: exact offline uv stdin dry-run passed
• fault-era Scheduler source at d1681f86: same Bundle staged and passed
• Ruff check/format, Pyright (0 errors on changed files), uv lock --check, git diff --check: passed
• full pre-commit, including hardcoded-secret detection: passed
• Apache-2.0 headers on all changed files: verified

Baseline note

On current upstream main, tests/cli/test_studio_deploy_target.py has inherited local failures because the newly added IAM preflight runs before older placeholder-credential tests reach their mocks. The same module passed before rebasing, and none of this PR's four files touches IAM or that test module.

No Studio release, Release Server deployment, cloud dependency-task canary, or customer Function mutation was performed.