feat(installer): require the wheelhouse to satisfy requirements.txt, and lock the real payload

The lock records what IS in the wheelhouse, not what the application NEEDS, so
an incomplete wheelhouse was locked, blessed and shipped - and only failed on an
air-gapped server.

That is not hypothetical. Assembling the wheelhouse anywhere other than Windows
silently omits colorama, a win32-only dependency of click, because pip evaluates
environment markers against the machine doing the downloading rather than the
machine being targeted. The bundle built here was short exactly that one wheel.

Both verifiers now cross-check wheels/ against the staged requirements.txt,
ignoring markers, since a requirement guarded by sys_platform == 'win32' is
precisely the one that must be present. Names are normalised to PEP 427 wheel
form, so mysql-connector-python matches mysql_connector_python.

bundle-lock.json is the first real lock: 42 files, cp314/win_amd64 - 39 wheels,
Python 3.14.6, HttpPlatformHandler 1.2 and URL Rewrite. MySQL is absent and
optional; a site choosing the bundled-database option adds it and re-locks.

The naming gate now skips the installer's build output. It contains a staged
copy of the application plus a second SPA build under dist-subpath, which
--exclude-dir=dist does not match, so a staged bundle failed the gate on
vendored minified JS nobody in this repository wrote.

deploy/windows/installer/verify_bundle_lock.py

@@ -22,6 +22,7 @@ Usage: verify_bundle_lock.py <bundle-root> <bundle-lock.json>
 import hashlib
 import json
 import os
+import re
 import sys
 
 # Must match $script:BundlePayloads in bundle-lock.ps1.
@@ -55,6 +56,54 @@ def payload_files(directory):
     return found
 
 
+def normalize(name):
+    """PEP 427 wheel filename form: runs of non-alphanumerics become one _."""
+    return re.sub(r'[^A-Za-z0-9.]+', '_', name).lower()
+
+
+def requirement_pins(requirements_path):
+    """Every 'name==version' pinned in a lockfile, including marked-out ones.
+
+    Markers are deliberately IGNORED. A requirement guarded by
+    sys_platform == 'win32' is exactly the case that must be present, because the
+    target is Windows and the wheelhouse is usually assembled somewhere else.
+    """
+    pins = {}
+    with open(requirements_path) as fh:
+        for line in fh:
+            line = line.strip()
+            if not line or line.startswith('#'):
+                continue
+            match = re.match(r'^([A-Za-z0-9._-]+)==([^\s;\\]+)', line)
+            if match:
+                pins[normalize(match.group(1))] = match.group(2)
+    return pins
+
+
+def check_wheelhouse_covers_requirements(bundle_root):
+    """The lock records what IS in the wheelhouse, not what the app NEEDS.
+
+    Without this, an incomplete wheelhouse gets locked and blessed, and the
+    install fails on an air-gapped server. That is not hypothetical: assembling
+    the wheelhouse on Linux silently omits colorama, a win32-only dependency of
+    click, because pip evaluates environment markers against the machine doing
+    the downloading rather than the machine being targeted.
+    """
+    wheels = os.path.join(bundle_root, 'wheels')
+    requirements = os.path.join(bundle_root, 'app', 'requirements.txt')
+    if not os.path.isdir(wheels) or not os.path.exists(requirements):
+        return []
+    have = os.listdir(wheels)
+    problems = []
+    for name, version in sorted(requirement_pins(requirements).items()):
+        prefix = '%s-%s-' % (name, version)
+        if not any(f.lower().startswith(prefix) for f in have):
+            problems.append(
+                'wheels/ has no wheel for %s==%s, which requirements.txt pins '
+                '(a marked-out dependency still installs on Windows)' % (name, version))
+    return problems
+
+
 def verify(bundle_root, lock):
     problems = []
     locked = lock.get('payloads')
@@ -97,6 +146,7 @@ def verify(bundle_root, lock):
                 problems.append(
                     '%s/%s is in the bundle but NOT in the lock (unexpected extra file)'
                     % (name, rel))
+    problems.extend(check_wheelhouse_covers_requirements(bundle_root))
     return problems