Nightly minimum-dependency job drifts from the floors pyproject.toml declares — nothing enforces the 1:1 the step comment claims #969

.github/workflows/nightly.yml's test-min-deps job installs a hand-written list of exact dependency floors with --no-deps, so that the job tests the minimum versions the project claims to support. The step's own comment names the invariant:

Keep 1:1 with the pyproject [project].dependencies minimums.

Nothing enforces it. The pins are literal strings (torch==2.4.0, transformers==5.3.0, huggingface_hub==1.3.0, peft==0.19.0, accelerate==1.4.0, datasets==4.7.0, trl==1.0.0, pydantic==2.0.0, …) next to a pyproject.toml whose floors are edited independently.

Two ways this goes wrong:

• Floor raised deliberately — a compatibility or CVE floor moves in pyproject.toml and the nightly job keeps testing the old one, going green against a combination the project no longer supports.
• Floor lowered or dropped — a dependency is removed from pyproject.toml and the job keeps installing it, or a new runtime dependency is added and the job crashes in import forgelm before any test runs.

.github/dependabot.yml (#964) reduces the automated case: versioning-strategy: widen raises ceilings rather than floors. It does not close it — a deliberate floor raise is a manual edit, and nothing makes the night's pins move with it.

This is the same class the project has closed before: a documented requirement that no guard checks (see the budget_history ratchet note in docs/roadmap/risks-and-decisions.md).

Acceptance criteria

• A guard fails when nightly.yml's pinned floors disagree with the minimums pyproject.toml declares. The shape already exists: tests/test_packaging.py asserts the [dev] ranges equal the ones ci.yml's lint job installs.
• Or the pins are generated from pyproject.toml into a file the workflow consumes, so there is no second list to keep in step.
• Whichever route is taken, docs/standards/testing.md records the invariant the guard now enforces.