repro_deps_pinned unconditionally flags exact-pinned requirements.txt as a loose manifest

[Jaydeep869]

Description

repro_deps_pinned automatically fails any project that uses requirements.txt without a separate lockfile, even when every dependency inside requirements.txt is strictly pinned to an exact version (==) or contains cryptographic hashes. While #416 mentions checking frozen-form requirements in its roadmap, current repro_deps_pinned_handler unconditionally returns a hard FAIL.

What We Did

1. Created a Python project with requirements.txt containing strictly pinned dependencies (such as numpy==2.5.2 or click==8.1.7).
2. Ran darnit audit . --framework reproducibility --show-all.

What It Was Supposed To Do

The check should inspect the contents of requirements.txt. If all dependencies specify exact versions (==) or --hash, it should pass (or return a warning about transitive resolution), rather than failing outright as an unpinned loose manifest.

What We Got

The check returned a hard FAIL:

✗ RE-01.01: FAIL - Dependency manifests found but no lock files: requirements.txt (pip requirements)

Proposed Fix

In repro_deps_pinned_handler, inspect the lines in requirements.txt:

1. If any line uses open or range specifiers (>=, ~=, >, *), flag as FAIL.
2. If all non-comment lines use exact pins (==) or hashes, return PASS (with lower confidence) or WARN recommending a formal lockfile for transitive resolution.

Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/README.md#issue-2-false-positive-repro_deps_pinned-unconditionally-flags-exact-pinned-requirementstxt-as-loose-manifests