supply-chain: hash-pin prod dependencies (requirements-prod.lock)

Prod previously installed via 'pip install .' (reads unbounded requirements.py3.txt)
plus 'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved to
whatever PyPI served, unverified. A poisoned release of any dep (stripe, boto3,
sqlalchemy, pyramid...) would land in a payment app.

- requirements-prod.in: source (runtime + prod-server deps)
- requirements-prod.lock: 68 pkgs pinned to exact versions + SHA256 (854 hashes),
  generated with uv pip compile --generate-hashes
- install-source-prod now: pip install --require-hashes -r requirements-prod.lock
  then pip install --no-deps . — no floating resolve at deploy time
- make pins-lock regenerates the lock deliberately

Validated locally: lock installs under --require-hashes, app imports, 791 logic
tests pass under resolved versions (functional tests need MPS_TEST_* env, gated in CI).

Makefile

@@ -131,14 +131,23 @@ install-source-dev-and-test: venv
 	$(PIP) install --upgrade -r requirements-test.txt
 
 # Install from source for production (non‑editable).
+# Supply-chain: deps install from requirements-prod.lock (exact versions + SHA256
+# per dep, --require-hashes). No floating --upgrade; nothing resolves at deploy.
+# Regenerate the lock with: make pins-lock
 install-source-prod: venv
 	@echo "Ensuring setuptools is installed (required by Pyramid on Python 3.12+)..."
 	$(PIP) install 'setuptools<81'
 	@echo "Deleting tests from source code for production..."
 	rm -rf make_post_sell/tests
-	@echo "Installing make_post_sell from source for production (non‑editable)..."
+	@echo "Installing pinned, hash-verified dependencies (supply-chain)..."
-	$(PIP) install .
+	$(PIP) install --require-hashes -r requirements-prod.lock
-	$(PIP) install --upgrade -r requirements-prod.txt
+	@echo "Installing make_post_sell from source (no-deps; deps pinned above)..."
+	$(PIP) install --no-deps .
+
+# Regenerate requirements-prod.lock from requirements-prod.in (latest compatible).
+pins-lock:
+	uv pip compile --generate-hashes --upgrade --python-version 3.12 \
+		-o requirements-prod.lock requirements-prod.in
 
 # -----------------------------------------------------------------------------
 # Database Initialization and Server Targets

requirements-prod.in

@@ -0,0 +1,6 @@
+# Source for the hash-locked prod requirements (requirements-prod.lock).
+# Combines runtime deps (setup.py install_requires reads requirements.py3.txt)
+# with prod server deps. Regenerate the lock with:
+#   pip-compile --generate-hashes --upgrade -o requirements-prod.lock requirements-prod.in
+-r requirements.py3.txt
+-r requirements-prod.txt