Support explicit build constraints in install flows

[nailo2c]

This is PR 2 of the four-PR replacement for #65511.

It lets image and in-container installation flows consume an explicitly configured build constraints URL or local non-empty file. When no build constraints location is configured, the existing installation commands remain unchanged and perform no build-constraints download or inference.

The explicit constraints use the correct installer flags (uv --build-constraints and pip --build-constraint). Constraint-retry fallbacks remove both runtime and build constraints, while source uv sync installation remains unchanged.

This PR is intentionally opened as a draft while #68937 is unmerged. Its branch is based directly on main and does not contain PR 1 commits. The intended merge order is:

1. Generate and publish build constraints #68937
2. this PR
3. PR 3
4. PR 4

After #68937 merges, this PR will be rebased onto the updated main. Breeze-facing options and automatic selection of generated build constraints remain deferred to later PRs.

Validation:

• breeze run pytest scripts/tests/in_container/test_build_constraints_installation.py -xvs — 34 passed
• prek run update-inlined-dockerfile-scripts --all-files
• prek run ruff --from-ref upstream/main
• prek run ruff-format --from-ref upstream/main
• prek run --from-ref upstream/main --stage pre-commit
• prek run --from-ref upstream/main --stage manual
• CI image rebuilt successfully from the updated Dockerfile.ci
• selective checks confirm environment-file changes trigger the full CI matrix

related: #54394

---

Was generative AI tooling used to co-author this PR?

• Yes — Codex (GPT-5)

Generated-by: Codex (GPT-5) following the guidelines