Python: isolate dependency-bound validation

[eavanvalkenburg]

Motivation & Context

The dependency maintenance workflow reported newer FastAPI candidates for agent-framework-ag-ui as incompatible
before package checks could run. Package-scoped probes were following every optional extra and dependency group on
transitive workspace packages, so AG-UI's dependency on core pulled in the unrelated core[all] surface and DevUI's
FastAPI constraint.

This prevented valid dependency-bound updates and could produce similar false conflicts in upper-bound, lower-bound,
and test-mode validation.

Description & Review Guide

• What are the major changes? Add a shared selected-surface resolver for internal editable dependencies and use it
  consistently across upper-bound, lower-bound, and test-mode validation. Allow packages to define an implementation-
  focused dependency-pyright task, guard core tests that require optional integrations, add regression coverage,
  declare AG-UI's orchestration test dependency, and expand its validated FastAPI range through 0.139.x.
• What is the impact of these changes? Package probes retain their enabled groups and extras without inheriting
  unrelated aggregate extras from transitive packages. Core remains valid in an isolated install without connector
  packages, while normal repository checks still cover its lazy namespace stubs. AG-UI now supports
  fastapi>=0.121.0,<0.140.0.
• What do you want reviewers to focus on? Review the internal editable closure semantics, especially propagation
  of explicitly requested extras while excluding unselected aggregate surfaces such as core[all].

Related Issue

Fixes #7339

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	45583	4479	90%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9410	34 💤	0 ❌	0 🔥	1m 58s ⏱️

[Copilot]

Pull request overview

This PR fixes false dependency-bound validation conflicts in the Python workspace by ensuring package probes only follow the selected dependency groups/extras for internal editable dependencies, preventing aggregate surfaces (e.g., core[all]) from leaking into unrelated validations. It also updates agent-framework-ag-ui to validate FastAPI through the 0.139.x line and adds regression coverage for the new editable-resolution behavior.

Changes:

• Introduce shared workspace package metadata loading + a selected-surface internal-editables resolver, and use it across upper-bound, lower-bound, and test-mode validation flows.
• Add unit tests to prevent regressions in internal editable closure behavior (selected surface only; propagate explicitly requested transitive extras).
• Update AG-UI’s FastAPI upper bound to <0.140.0 and add a test dependency group requiring agent-framework-orchestrations (with corresponding lock updates).

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/uv.lock	Updates AG-UI metadata (FastAPI bound + test group editable dependency) in the lockfile.
python/scripts/dependencies/validate_dependency_bounds.py	Switches test-mode planning to shared workspace config + selected-surface internal editables resolution.
python/scripts/dependencies/tests/test_dependency_bounds_runtime.py	Adds regression tests covering internal editable closure semantics.
python/scripts/dependencies/README.md	Documents the refined internal editable resolution behavior (selected groups/extras only).
python/scripts/dependencies/_dependency_bounds_upper_impl.py	Uses shared workspace config + selected-surface editable resolution in upper-bound validation.
python/scripts/dependencies/_dependency_bounds_runtime.py	Adds WorkspacePackageConfig, workspace config loader, and resolve_internal_editables.
python/scripts/dependencies/_dependency_bounds_lower_impl.py	Uses shared workspace config + selected-surface editable resolution in lower-bound validation.
python/packages/ag-ui/pyproject.toml	Expands FastAPI supported range and adds test dependency group for orchestrations.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 91% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by eavanvalkenburg's agents

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 89% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by eavanvalkenburg's agents