Keep locked dep install on prod PyPI; run pip check before SDK override

Pass explicit production index flags on the hash-locked dependency
install so the PIP_INDEX_URL/PIP_EXTRA_INDEX_URL build args (pointed at
TestPyPI by the preview build scripts) don't leak in via pip's env
vars, and move pip check ahead of the SDK_VERSION override so a preview
SDK that deviates from the exact socketdev pin doesn't abort the build.

Addresses PR#289 review findings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

Dockerfile

@@ -114,9 +114,14 @@ RUN curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/p
 # Install Python dependencies from the lockfile with hash verification so the
 # image never resolves loose versions from PyPI at build time.
 COPY pyproject.toml uv.lock /tmp/socket-cli-lock/
+# Index flags are passed explicitly (always production PyPI) so the
+# PIP_INDEX_URL/PIP_EXTRA_INDEX_URL ARGs used to point CLI/SDK preview installs
+# at TestPyPI don't leak into the locked dependency install via pip's env vars.
 RUN uv export --directory /tmp/socket-cli-lock --frozen --no-dev --no-emit-project \
         --format requirements-txt -o /tmp/socket-cli-lock/requirements.txt && \
-    pip install --require-hashes --no-deps -r /tmp/socket-cli-lock/requirements.txt
+    pip install --require-hashes --no-deps \
+        --index-url https://pypi.org/simple --extra-index-url https://pypi.org/simple \
+        -r /tmp/socket-cli-lock/requirements.txt
 
 # Install CLI based on build mode
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
@@ -138,10 +143,10 @@ RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
             echo "Failed to install socketsecurity==$CLI_VERSION after 10 attempts"; \
             exit 1; \
         fi; \
+        pip check; \
         if [ ! -z "$SDK_VERSION" ]; then \
             pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \
         fi; \
-        pip check; \
     fi
 
 # Copy local source and install in editable mode if USE_LOCAL_INSTALL is true