Add version pinning via juliapkg.pinned.json and freeze()

[MilesCranmerBot]

Implements the version pinning proposal from JuliaPy/PythonCall.jl#805 (see the design discussion there).

juliapkg.freeze(target) (also python -m juliapkg freeze --target=...) records the exact version of every resolved registry package into a juliapkg.pinned.json file next to the target juliapkg.json. On subsequent resolves, discovered pinned files seed the environment before the required packages are added, so Pkg's tiered preservation keeps every pin that is compatible with all requirements. Pinned packages that are not required are removed from the project afterwards, so stale pins get pruned rather than accumulating.

Pins are preferences, not requirements: conflicting pins (between files, or with any package's compat) are relaxed with a warning listing exactly what changed. A new pins config option (PYTHON_JULIAPKG_PINS / -X juliapkg-pins) selects prefer (default), strict (error instead of relaxing), or ignore. update() ignores pins so they can be refreshed by running update, testing, and freezing again.

The motivation is shipping Python packages with locked Julia dependencies: users get exactly the versions the author tested, and a newly published version of a deep dependency no longer reaches users automatically, which meaningfully narrows supply chain exposure (versions themselves are integrity-checked by Pkg against registry tree hashes, so pinning versions is sufficient). Because pins are soft, two Julia-backed Python packages with different pins still resolve together.

Notes:

• The pinned file intentionally reuses the {"packages": {name: {uuid, version}}} shape of juliapkg.json.
• Pinned files participate in the existing deps-file hash tracking, and the meta version is bumped since the meta format changed.
• Stdlibs and dev/path/url packages are excluded from freezing (they cannot be, or are already, pinned).
• New unit tests cover pin discovery/merging, manifest extraction, and script generation; new integration tests cover pinned resolve (including pruning of pin-only packages), relaxation on conflict, strict mode, and freeze.

[MilesCranmer]

(See suggestions)

[MilesCranmer]

Hey @cjdoris, what do you think?

I've been dogfooding this a bit with PySR and it seems nice to have. Then I can test the exact dependencies one of my users will install so I don't need to worry about new breakages or supply chain attacks.

[MilesCranmer]

*Edit: I found a couple bugs, fixing those now...

[MilesCranmerBot]

Pushed a hardening commit after further review of the edge cases:

• Pin cleanup now snapshots the project's direct dependencies before seeding and only removes packages the seeding itself added, so a shared project's own direct dependencies are never removed (new integration test covers this).
• Pin entries are validated (name/uuid regex, semver parse) before being interpolated into the generated Julia script: invalid entries are skipped with a warning in prefer mode and are an error in strict mode.
• Cross-file pin conflicts now compare uuid as well as version, and in strict mode they raise instead of silently keeping the first file.
• Pins that conflict with a required package's compat are dropped with a warning in prefer mode (error in strict) before resolution, instead of failing the whole resolve. Deeper conflicts discovered by the resolver fail loudly, consistent with how juliapkg treats requirement conflicts.
• freeze() errors if the target has no juliapkg.json (the pinned file would never be discovered), and reads the version-specific Manifest-vX.Y.toml when one exists.
• Pins are skipped with a warning on Julia < 1.4 (the generated code uses Pkg.project()/Pkg.dependencies()).

[MilesCranmer]

Ok after some messing around, this looks good from my perspective now. Up to you @cjdoris!