fix(python): deploy the runtime from the workspace lockfile

(cherry picked from commit c2e5f4828ecf698ba17c6b2eab67ff7b3a914d49)

python/sdk-runtime/README.i18n.yaml

@@ -15,5 +15,5 @@
   en: 0f476fb87a1a3349
   zh: 359dbd9b24b18b46
 /deepseek-harness-runtime-bin/build-and-distribution:
-  en: a41e8eb7e99b9532
-  zh: 2789d8f43b1b54be
+  en: 2512cd7c3624ef6e
+  zh: 455f6a528e5f9d61

python/sdk-runtime/README.md

@@ -62,7 +62,7 @@ External profile management uses `dsh plugin --profile <name> ...`. After explic
 
 ## Build and distribution
 
-Production deployment permits unused workspace patches for packages outside the runtime closure; patches for included packages must still apply successfully. This exception is confined to the deploy command; repository installation still rejects unused patches.
+Production deployment installs the workspace lockfile’s pinned dependency graph without re-resolving versions. It permits unused workspace patches for packages outside the runtime closure; patches for included packages must still apply successfully. This exception is confined to the deploy command; repository installation still rejects unused patches.
 
 From the repository root, `pnpm exec tsx scripts/build-exe-for-python-sdk.ts` verifies the closure, builds packages, deploys a symlink-free tree, packages the selected target, and syncs the executable and sidecars into this module. The executable stores embedded files with Brotli compression. Only the target platform’s PTY prebuilds are packaged. Package README, CHANGELOG, HISTORY Markdown, source maps, and TypeScript declarations outside runtime assets are omitted. Deployment disables workspace hoisting, and packaging excludes checkout dependencies and workspace source trees outside the deployment so dependency scans cannot add development packages to the payload. Staging shares root workspace packages with nested consumers of the same pnpm dependency identity, preserving singleton services while retaining different peer resolutions. `scripts/build-python-release.py` stages release-shaped wheels at the root repository version and pins `deepseek-harness-sdk` to the exact runtime version.
 

python/sdk-runtime/README.zh.md

@@ -62,7 +62,7 @@ Python 与打包的 bootstrap 共享资源布局：`<cache>/<identity>/office/`
 
 ## 构建与分发
 
-生产部署允许工作区中不属于运行时闭包的补丁保持未使用；闭包内包的补丁仍必须成功应用。此例外仅用于部署命令，仓库安装仍拒绝未使用的补丁。
+生产部署按工作区锁文件安装固定的依赖图，不重新解析版本。部署允许工作区中不属于运行时闭包的补丁保持未使用；闭包内包的补丁仍必须成功应用。此例外仅用于部署命令，仓库安装仍拒绝未使用的补丁。
 
 在仓库根目录运行 `pnpm exec tsx scripts/build-exe-for-python-sdk.ts`，会校验闭包、构建包、部署无符号链接的文件树、打包所选目标，并把可执行程序及伴随文件同步到本模块。可执行文件使用 Brotli 压缩存储内嵌文件。打包时只保留目标平台的 PTY 预构建文件，并排除运行时资源目录之外的包内 README、CHANGELOG、HISTORY Markdown 文档、source map 和 TypeScript 声明。部署会关闭工作区提升，打包时还会排除部署目录之外的检出依赖和工作区源码树，防止依赖扫描把开发包加入载荷。暂存步骤让使用相同 pnpm 依赖标识的嵌套消费者共享根目录的工作区包，保留服务单例，同时保留不同的对等依赖解析。`scripts/build-python-release.py` 按仓库根版本暂存发布形态的 wheel 包，并将 `deepseek-harness-sdk` 固定到完全相同的运行时版本。