Lock the dependency tree and raise the Python floor to 3.9

[alexevag]

Why

Rigs resolved dependencies fresh on every install, so a machine could pick up an untested release of numpy or pandas between sessions. This adds a locked environment for those machines, documents how the two layers of dependency control relate, and corrects the declared Python range.

What changed

requirements-lock.txt holds one pinned version per package across the whole dependency tree. Versions are the newest ones actually running on a verified machine, not whatever a resolver preferred. Environment markers keep it to a single cross-platform file. Hardware and analysis packages are excluded, since every such import in EthoPy is lazy and they are installed per machine.

Dependency policy is documented in the contributing guides: what pyproject.toml and the lock file each do, when an upper bound is justified, and the refresh procedure. The installation guide gains the reproducible install path and loses the reference to the obj extra, which no longer exists.

The Python floor moves from 3.8 to 3.9. The old floor was never real. numpy, pandas, scipy, h5py, scikit-learn, pynwb and datajoint all require 3.9 or newer, so the locked environment cannot install on 3.8 at all. requires-python, the classifiers, the mypy target and the version stated in five documentation files are now consistent.

The lock file needs 3.9.2 specifically, because cryptography excludes 3.9.0 and 3.9.1. That is noted in the lock header rather than in requires-python, so installing from the package index still works on any 3.9.

Verification

The lock file was compiled and checked for version drift on four targets, all resolving with no drift:

Python	Platform
3.9.2	aarch64 Linux
3.11	x86_64 Linux
3.10	x86_64 macOS
3.11	x86_64 Windows

The declared dependencies also resolve cleanly at the new 3.9 floor.

Known follow-ups, not in this PR

• urllib3 and pillow are pinned to versions predating several fixed security advisories. Bumping them within their tested majors needs a check on a rig first.
• The lock header says 80 of 87 pins are in the fleet; 7 are marked as not in the fleet and another 7 carry no provenance comment, so the marked count is 73.
• The install instructions use --no-deps, which silently omits any dependency added after the last refresh. Using the file as a constraints file instead would keep the pins and fail loudly on a mismatch.
• There is no workflow verifying the lock still resolves, so it will go stale silently.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WNpe4dpiSvnLeS11Gkpfw4