[codex] install backend Docker deps from uv locks (#8328)

## Summary
- install backend and pusher Docker Python dependencies from uv pylock
files
- add runtime-only backend and pusher-specific lock files for Linux
container builds
- update lock regeneration docs/script behavior so existing pins are
preserved by default and `PYLOCK_UPGRADE=1` performs intentional
upgrades
- add the missing pusher `google-cloud-tasks` dependency surfaced by
container smoke testing

## Validation
- `./scripts/update-python-lock.sh`
- `sh -n backend/scripts/update-python-lock.sh`
- workflow YAML parse checks for backend workflows
- `git diff --check`
- `./scripts/pre-commit`
- Oracle second-model review, with must-fix feedback addressed
- `docker pull --platform linux/amd64
gcr.io/based-hardware-dev/python:3.11-slim-forky`
- `docker build --platform linux/amd64 -f backend/Dockerfile -t
omi-backend-uv-runtime:gcr-test .`
- `docker run --rm --platform linux/amd64
omi-backend-uv-runtime:gcr-test python -c "from google.cloud import
tasks_v2; import fastapi, uvicorn, onnxruntime, lc3, av; print('backend
runtime imports ok')"`
- `docker build --platform linux/amd64 -f backend/pusher/Dockerfile -t
omi-pusher-uv-runtime:gcr-test .`
- `docker run --rm --platform linux/amd64 omi-pusher-uv-runtime:gcr-test
python -c "from google.cloud import tasks_v2; import fastapi, uvicorn,
lc3, av, scipy; print('pusher runtime imports ok')"`

## Notes
- `backend/test-preflight.sh` was not a useful signal on this machine
because the local shell is on Python 3.9 without backend packages
installed; Redis and test file checks were fine.
- Docker still reports the existing `$LD_LIBRARY_PATH` undefined-var
warning in these Dockerfiles; it does not block either image build.


<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/BasedHardware/omi/pull/8328?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Author: Git-on-my-level

backend/AGENTS.md

@@ -19,6 +19,8 @@ When intentionally changing backend Python dependencies, edit the relevant `requ
 ./scripts/update-python-lock.sh
 ```
 
+By default, the lock refresh preserves already-locked package versions so unrelated transitive upgrades do not sneak into infrastructure changes. Set `PYLOCK_UPGRADE=1` only when intentionally refreshing dependency versions.
+
 Key env vars: `OPENAI_API_KEY` (LLM calls — not `OPENAI_ADMIN_KEY` which is billing-only), `DEEPGRAM_API_KEY` (STT), `ENCRYPTION_SECRET` (required for tests), `REDIS_DB_HOST` (cache/rate-limiting, fail-open without it), `ADMIN_KEY` (local dev auth bypass via token `ADMIN_KEY<uid>`), `SERVICE_ACCOUNT_JSON` (Firestore/GCS credentials).
 
 ## Directory Structure

backend/Dockerfile

@@ -1,7 +1,13 @@
-FROM gcr.io/based-hardware-dev/python:3.11-slim-forky AS builder
+ARG PYTHON_BASE_IMAGE=gcr.io/based-hardware-dev/python:3.11-slim-forky
+ARG UV_VERSION=0.11.13
+
+FROM ${PYTHON_BASE_IMAGE} AS builder
+
+ARG UV_VERSION
 
-ENV PATH="/opt/venv/bin:$PATH"
 RUN python -m venv /opt/venv
+RUN python3 -m pip install --no-cache-dir "uv==${UV_VERSION}"
+ENV PATH="/opt/venv/bin:$PATH"
 
 # Install build dependencies for liblc3
 RUN apt-get update && apt-get install -y \
@@ -28,12 +34,12 @@ RUN git clone https://github.com/google/liblc3.git && \
     cd /tmp/liblc3 && \
     python3 -m pip wheel --no-cache-dir --wheel-dir /tmp/wheels .
 
-# Install Python requirements
+# Install Python requirements from the checked-in runtime lock.
 WORKDIR /opt/venv
-COPY backend/requirements.txt /tmp/requirements.txt
-RUN pip install --no-cache-dir --upgrade -r /tmp/requirements.txt
+COPY backend/pylock.runtime.toml /tmp/pylock.runtime.toml
+RUN uv pip sync /tmp/pylock.runtime.toml --python /opt/venv/bin/python --compile-bytecode
 
-FROM gcr.io/based-hardware-dev/python:3.11-slim-forky
+FROM ${PYTHON_BASE_IMAGE}
 
 WORKDIR /app
 ENV PATH="/opt/venv/bin:$PATH"

backend/pusher/Dockerfile

@@ -1,7 +1,13 @@
-FROM gcr.io/based-hardware-dev/python:3.11-slim-forky AS builder
+ARG PYTHON_BASE_IMAGE=gcr.io/based-hardware-dev/python:3.11-slim-forky
+ARG UV_VERSION=0.11.13
+
+FROM ${PYTHON_BASE_IMAGE} AS builder
+
+ARG UV_VERSION
 
-ENV PATH="/opt/venv/bin:$PATH"
 RUN python -m venv /opt/venv
+RUN python3 -m pip install --no-cache-dir "uv==${UV_VERSION}"
+ENV PATH="/opt/venv/bin:$PATH"
 
 # Install build dependencies for liblc3
 RUN apt-get update && apt-get install -y \
@@ -28,12 +34,12 @@ RUN git clone https://github.com/google/liblc3.git && \
     cd /tmp/liblc3 && \
     python3 -m pip wheel --no-cache-dir --wheel-dir /tmp/wheels .
 
-# Install Python requirements — pusher-specific (no torch/onnxruntime/pyannote)
+# Install Python requirements from the pusher-specific checked-in lock.
 WORKDIR /opt/venv
-COPY backend/pusher/requirements.txt /tmp/requirements.txt
-RUN pip install --no-cache-dir --upgrade -r /tmp/requirements.txt
+COPY backend/pusher/pylock.toml /tmp/pylock.toml
+RUN uv pip sync /tmp/pylock.toml --python /opt/venv/bin/python --compile-bytecode
 
-FROM gcr.io/based-hardware-dev/python:3.11-slim-forky
+FROM ${PYTHON_BASE_IMAGE}
 
 WORKDIR /app
 ENV PATH="/opt/venv/bin:$PATH"

backend/pusher/pylock.toml

@@ -19,6 +19,7 @@ pydantic_core==2.33.2
 firebase-admin==6.5.0
 google-cloud-firestore==2.20.0
 google-cloud-storage==2.18.0
+google-cloud-tasks==2.16.4
 google-cloud-translate==3.20.2
 google-auth==2.32.0
 google-api-python-client==2.139.0

backend/pusher/requirements.txt

@@ -2,7 +2,7 @@
 #    backend/scripts/update-python-lock.sh
 lock-version = "1.0"
 created-by = "uv"
-requires-python = ">=3.11.15"
+requires-python = ">=3.11,<3.12"
 
 [[packages]]
 name = "aenum"

backend/pylock.macos-x86_64.toml

@@ -2,7 +2,7 @@
 #    backend/scripts/update-python-lock.sh
 lock-version = "1.0"
 created-by = "uv"
-requires-python = ">=3.11.15"
+requires-python = ">=3.11,<3.12"
 
 [[packages]]
 name = "aenum"

backend/pylock.macos.toml

@@ -2,7 +2,7 @@
 #    backend/scripts/update-python-lock.sh
 lock-version = "1.0"
 created-by = "uv"
-requires-python = ">=3.11.15"
+requires-python = ">=3.11,<3.12"
 
 [[packages]]
 name = "aenum"

backend/pylock.runtime.toml

@@ -2,7 +2,7 @@
 #    backend/scripts/update-python-lock.sh
 lock-version = "1.0"
 created-by = "uv"
-requires-python = ">=3.11.15"
+requires-python = ">=3.11,<3.12"
 
 [[packages]]
 name = "aenum"