Cap anyio below the release that requires typing_extensions 4.16

[manasip-prog]

checks has been failing on main since 2026-09-02, independently of any change in this repo:

File ".../.venv/lib/python3.13/site-packages/anyio/_core/_typedattr.py", line 10
    from typing_extensions import sentinel
ImportError: cannot import name 'sentinel' from 'typing_extensions'
    (/nix/store/...python3.13-typing-extensions-4.15.0/...)

anyio 4.15.0 was released on 2026-09-02 — the same day as the last green run — and requires typing_extensions>=4.16.0. uv.lock is gitignored, so CI resolves fresh on every run and picked it up. The typing_extensions actually imported comes from the devshell's Nix python at 4.15.0, which predates the lowercase sentinel alias, and it takes precedence over the venv copy.

Adding typing_extensions as a direct dependency would not help — anyio already declares typing_extensions>=4.16.0 itself, and the venv copy is being shadowed regardless. Capping anyio is the reliable fix. Nothing in this repo imports anyio directly; it is only pulled in through FastAPI, and the cap has to be declared here because FastAPI's own constraint (anyio>=3.4.0,<5) is satisfied by the broken release.

This does not affect the workload image: Dockerfile.workload builds on the uv base image rather than the devshell, so there is no Nix copy to shadow the venv. build workload image passed on ripple/rippled-antithesis run 33933172074 on Sep 5, three days after anyio 4.15.0 shipped.

Unblocks #94.

🤖 Generated with Claude Code