fix(ci): use requirements file for pip hash verification in release smoke test and clusterfuzz build.sh script

[divisionseven]

Summary

Release pipeline smoke-test job fails because pip install --hash=sha256:... uses --hash as a CLI flag, but --hash is a per-requirement option valid only inside pip requirements files. pip ≥26.1.2 (ubuntu-24.04) rejects it with no such option: --hash. Fixed by writing the hash-pinned requirement to a temp file via printf and installing with pip install -r <file> --require-hashes.

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• 🧹 Chore (release preparation)

---

Motivation and Context

• Bug fix: The release pipeline (release.yml) failed at the "Install from PyPI (with propagation retry)" smoke-test step. Root cause: --hash was added for Scorecard Pinned-Dependencies compliance in commit a5d2aee but used as a CLI flag — pip only accepts --hash inside requirements files, verified against pip's own source code (SUPPORTED_OPTIONS_REQ vs SUPPORTED_OPTIONS in req_file.py) and official documentation.

• Release: Prepare v1.0.7 with the above fix as the release content.

---

Implementation Notes

• The --hash option is architecturally scoped to individual requirement lines in pip — it lives in SUPPORTED_OPTIONS_REQ (per-requirement), not SUPPORTED_OPTIONS (global CLI). The pip install CLI parser only registers --require-hashes as a CLI flag, not --hash.
• Both affected files (.github/workflows/release.yml and .clusterfuzzlite/build.sh) had the identical bug from the same Scorecard commit — fixed together.
• The pinned hash 4d1ec4a1...9d456 was verified against the PyPI JSON API — it's the correct SHA256 for the Linux x86_64 wheel of uv==0.5.1.
• Fix syntax was validated end-to-end: the broken command produces no such option: --hash, the requirements-file approach correctly parses and validates hashes.

---

Testing

• I have added tests that cover the changes in this PR
• All existing tests pass locally (pytest --cov-fail-under=90)
• I have run the e2e gate test locally (pytest tests/integration/test_smoke_e2e.py --tb=short -q)
• I have tested this manually (describe what you did below)

Manual testing performed:

Test	Result
pip install "uv==0.5.1" --hash=sha256:... --require-hashes	no such option: --hash
printf '...' > /tmp/req.txt && pip install -r /tmp/req.txt --require-hashes	Correct hash matching behavior
YAML validation (release.yml)	Valid
Shell syntax check (build.sh)	Valid

---

Checklist

• My code follows the project's style guidelines (passes ruff check . and ruff format --check .)
• My code passes type checking (mypy .)
• My changes maintain or improve code coverage (pytest --cov-fail-under=90)
• I have updated documentation as needed (README, docstrings, CHANGELOG)
• I have updated CHANGELOG.md with a brief entry under [Unreleased]
• My changes do not introduce new dependencies without discussion
• I am aware that the dependency review workflow runs automatically on PRs
• I have reviewed my own diff before requesting review

---

Related Issues / PRs

Fixes the release pipeline smoke-test failure identified in run 30035166772.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!