supply-chain: hash-pin prod PyPI dependencies (requirements-prod.lock)

Prod previously installed via 'pip install .' (unbounded requirements.py3.txt) plus
'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved external
PyPI deps to whatever was latest, unverified.

- requirements-prod.in: source (runtime + prod-server deps)
- requirements-prod.lock: 55 PyPI pkgs pinned to exact versions + SHA256 (622 hashes)
- scripts/strip-vcs-from-lock.py: removes first-party git theme deps (pip can't hash
  a git repo; themes are integrity-pinned by their own commit SHAs)
- install-source-prod: pip install --require-hashes -r requirements-prod.lock, then
  pip install . to resolve the first-party git themes without re-resolving the
  hash-pinned PyPI deps
- make pins-lock regenerates the lock deliberately

Validated locally: stripped lock installs under --require-hashes, app imports under
resolved versions (SQLAlchemy 2.0, Pyramid latest).

scripts/strip-vcs-from-lock.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Strip VCS (git+) entries from a uv/pip-compile lock file.
+
+pip's --require-hashes mode rejects every requirement that lacks a hash, and a
+VCS dependency (git+ssh / git+https) cannot be hashed. Our git-hosted themes are
+first-party repos, integrity-pinned by their own commit SHAs, and install via
+'pip install .' at deploy time — so we remove them from the hash-locked PyPI set.
+
+Usage: strip-vcs-from-lock.py requirements-prod.lock
+"""
+import re
+import sys
+
+path = sys.argv[1]
+lines = open(path).read().splitlines()
+out, skip, removed = [], False, []
+for ln in lines:
+    if skip:
+        if ln[:1] in (" ", "\t"):  # continuation (# via) of a skipped VCS entry
+            continue
+        skip = False
+    if re.match(r"^\S.*@ git\+", ln):
+        removed.append(ln.split(" @ ")[0])
+        skip = True
+        continue
+    out.append(ln)
+open(path, "w").write("\n".join(out) + "\n")
+print("stripped VCS deps:", removed or "(none)")