chore(ci): hash-pin website build deps via require-hashes lock (Scorecard)

[SoundMindsAI]

What

Resolves the two code-fixable OSSF Scorecard Pinned-Dependencies mediums on the code-scanning page:

Alert	Location	Finding
#89	.github/workflows/build-guides-freshness.yml:68	pip install not pinned by hash
#73	.github/workflows/deploy-docs.yml:44	pip install not pinned by hash

Both workflows installed website/requirements.txt, which pins exact versions (==) but not by sha256 hash.

How

• Added website/requirements.lock — a fully hash-pinned (sha256) lock compiled from the curated website/requirements.txt via uv pip compile --generate-hashes, covering the whole transitive tree.
• Both workflows now run pip install --require-hashes -r website/requirements.lock and key the pip cache on the lock.
• website/requirements.txt stays the human-curated top-level source (with a regenerate-the-lock pointer in its header); the lock carries a GENERATED / do-not-edit header with the same regen command.

requirements.txt is hand-bumped — Dependabot's pip ecosystem only watches the repo root (uv.lock), not website/ — so there's no auto-update drift between the two files.

Verification

✅ Ran pip install --require-hashes -r website/requirements.lock in a clean venv — succeeds and resolves mkdocs-material 9.7.6 / pymdown-extensions 10.21.3 / mkdocs-glightbox 0.5.2.

Scope notes (other Scorecard mediums)

• docs: state.md checkpoint — pre-MVP2 sweep Wave 2 (14 items, 9 PRs total) #85 (npm install -g pnpm@9 not hash-pinned, ui/Dockerfile) — not fixed here. corepack was removed from node:26-bookworm-slim, and the slim base has no curl/wget, so every "pin pnpm" workaround re-introduces an equal-or-worse unpinned install (npm install -g corepack or apt-get install curl). Dismissed as accepted-risk instead.
• infra(skills): add /bug-fix skill for medium-sized bug fixes #71 (SAST) / docs: post-release v0.1.0 housekeeping — state.md + CLAUDE.md row 12 #69 (Fuzzing) — process/governance findings, no code fix (CodeQL already runs on all PRs; fuzzing is out of scope for this project). Dismissed as accepted-risk.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a hash-pinned dependency lock file (website/requirements.lock) generated via uv to ensure reproducible and secure public-site builds. Additionally, it updates the comments in website/requirements.txt to document the lock file's purpose and provide instructions on how to regenerate it. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.