Pin dependency versions in requirements.txt

The MCP Space's Docker build re-resolves requirements.txt whenever the
file changes or its pip layer cache is evicted (e.g. a factory rebuild),
so an unpinned '>=' floor could float to a breaking release and silently
break the deploy -- as an unpinned gradio floated to 6.x and broke the
Path B web app's first build this cycle. Pin all eight dependencies to
the versions the project currently runs on; bump them deliberately.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

requirements.txt

@@ -1,11 +1,16 @@
 # CanLex dependencies. Install into the project venv:
 #   py -m venv .venv
 #   .venv\Scripts\python.exe -m pip install -r requirements.txt
-mcp>=1.2               # MCP server (server.py)
-numpy>=2.0             # vector math for hybrid retrieval (index.py)
-onnxruntime>=1.20      # embedding + reranker model runtime (embed.py, rerank.py)
-huggingface-hub>=0.20  # one-time model downloads (embed.py, rerank.py)
-tokenizers>=0.20       # tokenization for the embedding and reranker models
-beautifulsoup4>=4.12   # parse CBSA D-Memoranda HTML (dmemo.py)
-pypdf>=4.0             # extract text from PDF-only D-Memoranda (dmemo.py)
-snowballstemmer>=2.2   # English stemmer for keyword search (index.py)
+#
+# Versions are pinned for reproducible builds: the MCP Space's Docker image
+# re-resolves this file whenever it changes or its pip layer cache is evicted
+# (e.g. a factory rebuild), so an unpinned floor could float to a breaking
+# release and silently break the deploy. Bump these deliberately.
+mcp==1.27.1              # MCP server (server.py)
+numpy==2.4.6             # vector math for hybrid retrieval (index.py)
+onnxruntime==1.26.0      # embedding + reranker model runtime (embed.py, rerank.py)
+huggingface-hub==1.15.0  # one-time model downloads (embed.py, rerank.py)
+tokenizers==0.23.1       # tokenization for the embedding and reranker models
+beautifulsoup4==4.14.3   # parse CBSA D-Memoranda HTML (dmemo.py)
+pypdf==6.11.0            # extract text from PDF-only D-Memoranda (dmemo.py)
+snowballstemmer==3.0.1   # English stemmer for keyword search (index.py)