Generate and publish build constraints

[nailo2c]

This is PR 1 of the four-PR replacement for #65511.

It generates pinned build constraints from workspace and locked sdist build metadata, uploads them with the existing constraints artifacts, and publishes them to the constraints branch.

The generated build-constraints-*.txt files are inert in this PR. Airflow installation flows do not consume them yet.

Validation:

• breeze run pytest scripts/tests/in_container/test_generate_build_constraints.py -xvs — 68 passed
• prek run ruff --from-ref upstream/main
• prek run ruff-format --from-ref upstream/main
• prek run --from-ref upstream/main --stage pre-commit
• prek run --from-ref upstream/main --stage manual
• Python 3.10 generation verified for all three modes with identical non-comment build constraints, unchanged runtime constraints, and a reused sdist cache
• publication dry-run created a local constraints commit containing the new build constraints and only expected constraints .txt files; nothing was pushed

related: #54394

---

Was generative AI tooling used to co-author this PR?

• Yes — Codex (GPT-5)

Generated-by: Codex (GPT-5) following the guidelines