Keep Hosted Agent dependency policy focused on reproducibility

[Wei Meng (m5i-work)]

Summary

• keep the Hosted Agent dependency policy focused on dependency-artifact reproducibility
• validate uv lock freshness, complete versioned graph, safe sources, and frozen production export
• leave build metadata and deployment behavior to build-readiness and live E2E validation
• add coverage proving a new uv-native runtime passes with only the dependency artifacts required by this policy

Why

The uv migration in #992 exposed that the policy had coupled reproducible dependency artifacts to an unrelated repository validation/deployment convention. The credential-free checker can prove the lock itself without requiring build metadata, while live E2E owns actual build and deployment verification.

This restores the separation established by #848 while retaining the intentional uv-first evolution: pyproject.toml + uv.lock is preferred, and a fully resolved requirements.txt remains the compatibility fallback.

Validation

• dependency-policy suite: 42 tests pass
• all hosted-agent contract/fixture/workflow policy tests pass
• checker against Migrate some Python Agent Framework samples to uv #992 base/head without --resolve: pass
• checker against Migrate some Python Agent Framework samples to uv #992 base/head with --resolve and uv==0.11.7: pass
• real GitHub policy runs on this PR and Migrate some Python Agent Framework samples to uv #992
• black --check and git diff --check

[Wei Meng (m5i-work)]

Live verification is complete. The standalone fix PR passed the hosted-agent policy workflow: https://github.com/microsoft-foundry/foundry-samples/actions/runs/35571553164. I also applied the same fix to the real 18-sample uv migration in #992; its previously failing dependency-policy job now passes: https://github.com/microsoft-foundry/foundry-samples/actions/runs/35571607988. Local --resolve validation against the complete #992 tree also passed with uv 0.11.7.

[Wei Meng (m5i-work)]

Updated to the agreed long-term design: the checker now enforces only dependency-artifact reproducibility and no longer inspects build/deployment metadata. It still validates artifact selection, lock freshness, the complete versioned graph, source portability, uv lock --check, and frozen production export. Live policy run: https://github.com/microsoft-foundry/foundry-samples/actions/runs/35573862587.