Complete RC6 supply chain gates

scripts/generate_python_lock.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CONTAINER="geointel-lockgen-$$"
+PYTHON_IMAGE="python:3.11-bookworm@sha256:5c34b355088846dddc8afb7442c20b9433dccdc8d66192dc52c616adeaa106a3"
+PIP_TOOLS_VERSION="7.5.3"
+
+cleanup() {
+  docker rm -f "$CONTAINER" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+command -v docker >/dev/null 2>&1 || {
+  echo "Docker is required to generate the Linux Python lock." >&2
+  exit 1
+}
+
+docker run -d \
+  --name "$CONTAINER" \
+  -v "$ROOT:/workspace" \
+  -w /workspace/backend \
+  "$PYTHON_IMAGE" \
+  sleep infinity >/dev/null
+
+docker exec "$CONTAINER" \
+  python -m pip install --disable-pip-version-check "pip-tools==$PIP_TOOLS_VERSION"
+docker exec "$CONTAINER" \
+  python -m piptools compile pyproject.toml \
+    --extra gis \
+    --output-file requirements-runtime.lock \
+    --strip-extras \
+    --generate-hashes \
+    --quiet
+docker exec "$CONTAINER" \
+  python -m piptools compile pyproject.toml \
+    --extra gis \
+    --extra dev \
+    --output-file requirements-ci.lock \
+    --strip-extras \
+    --generate-hashes \
+    --quiet
+docker exec "$CONTAINER" \
+  python /workspace/scripts/verify_python_lock.py --stamp
+
+echo "Generated runtime and CI locks in pinned Linux/Python 3.11."