[Pepps233]

Summary

Update the shared Python evaluation environment to current stable dependencies and fix the Python security advisories.

Reasoning

GitHub scans the Python lock separately from npm. The critical certifi finding and aiohttp/OpenTelemetry/PyJWT/multidict/urllib3 advisories require a coherent lock refresh. DeepSWE's E2B overlay predates the project gaining Harbor's E2B extra; one checked-in lock is now preferable to independently resolved runtime overlays.

Changes

• Pin Harbor 0.24.0, Daytona 0.226.1, E2B 2.59.0, Pydantic 2.14.1, PyYAML 6.0.3, and Hatchling 1.32.4.
• Refresh the 134-package lock, including certifi 2026.10.23, aiohttp 3.14.5, OpenTelemetry API 1.45.1, PyJWT 2.15.1, multidict 7.2.1, and urllib3 2.8.0.
• Record prerelease = "if-necessary" for required beta-only OpenTelemetry instrumentation transitives; direct requirements remain exact stable versions.
• Align strict Harbor/Daytona/E2B runtime guards and remove redundant DeepSWE --with overlays.
• Update export fixtures and add a mismatched-Harbor rejection regression.
• Synchronize live documentation and correct stale full-run instructions to the already configured 113×1 behavior. No trial counts, concurrency, retry, model, or paid execution settings changed. Historical repair/qualification records remain unchanged.

Testing

• uv lock --check and uv pip check passed.
• Wheel-only install: uv sync --locked --no-build --no-install-project --no-python-downloads passed; no build hooks run.
• 198 Terminal-Bench unit tests and 15 DeepSWE mocked tests passed with credentials cleared.
• Node launcher regression passed; all three launchers passed zsh -n.
• npm run check, npm ls --all, and ./test.sh passed for the complete stack.

Linux Docker smokes, live service qualification, and Hatchling build execution were not run. No benchmark jobs, paid sandboxes, or provider requests were launched.