fix(strix): persist 1.5.3 reports and watch the hashed lock

[cursor]

Problem

Required Strix on strix-agent==1.0.4 can finish a real scan, print Penetration test completed, then exit before a durable report exists. The fail-closed gate (#891) then fails the required check even though the console already listed findings. That is a buyer-visible security-dashboard miss on every ruleset consumer.

A lock-only change also used to skip Strix quality CI, so the pin/override contract would not re-run when the install set changed.

Change

This is the landing successor to #961 (31dd4c94) plus the lock-watch and report-layout contract.

• Pin strix-agent==1.5.3 (atomic CSV/MD writes; quit after scan).
• Keep cryptography==50.0.0 (CVE-2026-39892 floor + CVE-2026-69247 PKCS#7 timing-oracle fix).
• Resolve the stale cryptography<49 bound only at compile time via requirements-strix-ci-overrides.txt and ./scripts/ci/compile_strix_ci_lock.sh.
• Install the complete hashed lock with pip install --require-hashes --no-deps.
• Retrigger quality CI when requirements-strix-ci.txt or requirements-strix-ci-hashes.txt changes.
• Prove the unchanged gate still requires strix_runs/<run>/vulnerabilities/*.md and still rejects console TUI lines.

The missing-artifact rule is not weakened.

Next action

1. Land fix(strix): install hashed locks without pip re-resolution #969 on protected main first. Required Strix is pull_request_target, so this lock cannot install until main's installer uses --no-deps and pip-audit uses --disable-pip on complete hashed locks.
2. Rebase this head onto that new main.
3. Re-run exact-head install, import, CLI, quality, security, SBOM, and independent review.
4. Merge only after current-head checks are green and a non-author approval exists. Do not self-approve. Do not merge fix(strix): persist 1.5.3 reports without dropping cryptography 50 #961 in parallel.

Closes #952.

Refs #961 and #969.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.