fix(ci): compare requirements.txt drift against git, not a scratch export

.github/workflows/ci.yml

@@ -461,8 +461,22 @@ jobs:
       - name: Check requirements.txt matches uv.lock
         working-directory: examples/ag-ui/python
         run: |
-          uv export --no-hashes -o /tmp/requirements.check.txt
-          if ! diff -u requirements.txt /tmp/requirements.check.txt; then
+          # requirements.txt is what the Dockerfile installs from; uv.lock is what
+          # dependency bumps actually update. Regenerate in place with the very
+          # command the file records in its own header — uv stamps both the flags
+          # and the -o path there, so exporting to a scratch path or dropping
+          # --no-dev can never match a correctly-generated file — and let
+          # `git diff` compare against the committed version.
+          if ! head -1 requirements.txt | grep -q 'autogenerated by uv'; then
+            echo "examples/ag-ui/python/requirements.txt is hand-maintained, not a uv export — skipping drift check."
+            exit 0
+          fi
+          flags="--no-hashes"
+          if sed -n 2p requirements.txt | grep -q -- '--no-dev'; then
+            flags="$flags --no-dev"
+          fi
+          uv export $flags -o requirements.txt
+          if ! git diff --exit-code -- requirements.txt; then
             echo "::error::examples/ag-ui/python/requirements.txt is stale — the Railway image installs from this file, not uv.lock. Run 'uv export --no-hashes -o requirements.txt' in examples/ag-ui/python and commit the result."
             exit 1
           fi
@@ -567,8 +581,22 @@ jobs:
             echo "No requirements.txt in ${{ matrix.cap.python }} — skipping drift check."
             exit 0
           fi
-          uv export --no-hashes -o /tmp/requirements.check.txt
-          if ! diff -u requirements.txt /tmp/requirements.check.txt; then
+          # requirements.txt is what the Dockerfile installs from; uv.lock is what
+          # dependency bumps actually update. Regenerate in place with the very
+          # command the file records in its own header — uv stamps both the flags
+          # and the -o path there, so exporting to a scratch path or dropping
+          # --no-dev can never match a correctly-generated file — and let
+          # `git diff` compare against the committed version.
+          if ! head -1 requirements.txt | grep -q 'autogenerated by uv'; then
+            echo "${{ matrix.cap.python }}/requirements.txt is hand-maintained, not a uv export — skipping drift check."
+            exit 0
+          fi
+          flags="--no-hashes"
+          if sed -n 2p requirements.txt | grep -q -- '--no-dev'; then
+            flags="$flags --no-dev"
+          fi
+          uv export $flags -o requirements.txt
+          if ! git diff --exit-code -- requirements.txt; then
             echo "::error::${{ matrix.cap.python }}/requirements.txt is stale relative to uv.lock — deployments/ag-ui-dev is generated from this file. Run 'uv export --no-hashes -o requirements.txt' in ${{ matrix.cap.python }} and commit the result."
             exit 1
           fi

cockpit/runtimes/aws-strands/python/requirements.txt

@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv export --no-hashes -o requirements.txt
+#    uv export --no-hashes --no-dev -o requirements.txt
 -e .
 ag-ui-a2ui-toolkit==0.0.4
     # via ag-ui-strands

cockpit/runtimes/microsoft-agent-framework/python/requirements.txt

@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv export --no-hashes -o requirements.txt
+#    uv export --no-hashes --no-dev -o requirements.txt
 -e .
 ag-ui-protocol==0.1.21
     # via agent-framework-ag-ui