Python: isolate dependency-bound validation

[eavanvalkenburg]

Motivation & Context

The dependency maintenance workflow reported newer FastAPI candidates for agent-framework-ag-ui as incompatible
before package checks could run. Package-scoped probes were following every optional extra and dependency group on
transitive workspace packages, so AG-UI's dependency on core pulled in the unrelated core[all] surface and DevUI's
FastAPI constraint.

This prevented valid dependency-bound updates and could produce similar false conflicts in upper-bound, lower-bound,
and test-mode validation.

Description & Review Guide

• What are the major changes? Add a shared selected-surface resolver for internal editable dependencies and use it
  consistently across upper-bound, lower-bound, and test-mode validation. Add regression coverage, declare AG-UI's
  orchestration test dependency, and expand its validated FastAPI range through 0.139.x.
• What is the impact of these changes? Package probes retain their enabled groups and extras without inheriting
  unrelated aggregate extras from transitive packages. AG-UI now supports fastapi>=0.121.0,<0.140.0.
• What do you want reviewers to focus on? Review the internal editable closure semantics, especially propagation
  of explicitly requested extras while excluding unselected aggregate surfaces such as core[all].

Related Issue

Fixes #7339

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	45565	4474	90%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9407	33 💤	0 ❌	0 🔥	2m 24s ⏱️

[Copilot]

Pull request overview

This PR fixes false dependency-bound validation conflicts in the Python workspace by ensuring package probes only follow the selected dependency groups/extras for internal editable dependencies, preventing aggregate surfaces (e.g., core[all]) from leaking into unrelated validations. It also updates agent-framework-ag-ui to validate FastAPI through the 0.139.x line and adds regression coverage for the new editable-resolution behavior.

Changes:

• Introduce shared workspace package metadata loading + a selected-surface internal-editables resolver, and use it across upper-bound, lower-bound, and test-mode validation flows.
• Add unit tests to prevent regressions in internal editable closure behavior (selected surface only; propagate explicitly requested transitive extras).
• Update AG-UI’s FastAPI upper bound to <0.140.0 and add a test dependency group requiring agent-framework-orchestrations (with corresponding lock updates).

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/uv.lock	Updates AG-UI metadata (FastAPI bound + test group editable dependency) in the lockfile.
python/scripts/dependencies/validate_dependency_bounds.py	Switches test-mode planning to shared workspace config + selected-surface internal editables resolution.
python/scripts/dependencies/tests/test_dependency_bounds_runtime.py	Adds regression tests covering internal editable closure semantics.
python/scripts/dependencies/README.md	Documents the refined internal editable resolution behavior (selected groups/extras only).
python/scripts/dependencies/_dependency_bounds_upper_impl.py	Uses shared workspace config + selected-surface editable resolution in upper-bound validation.
python/scripts/dependencies/_dependency_bounds_runtime.py	Adds WorkspacePackageConfig, workspace config loader, and resolve_internal_editables.
python/scripts/dependencies/_dependency_bounds_lower_impl.py	Uses shared workspace config + selected-surface editable resolution in lower-bound validation.
python/packages/ag-ui/pyproject.toml	Expands FastAPI supported range and adds test dependency group for orchestrations.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 91% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by eavanvalkenburg's agents

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 89% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by eavanvalkenburg's agents