Align API lock metadata and add Factory Python 3.12 runtime recipe

[flujo-app]

Factory's Python 3.12 runtime needs the API extra declared in the lock and a compiler for the locked cpufeature sdist. Add the missing direct API dependency and requirement for httpx, without changing any resolved version or artifact hash. Add a Linux amd64 recipe using the existing pinned Python/uv bases, build-essential during installation, uv sync --locked --extra api, and the lock's Torch/CUDA dependency set. Factory supplies its coordinator, TLS configuration, callbacks and model snapshot.

Validation: all 35 declared requirements match the lock root metadata (with uv's Darwin marker normalization); the parsed lock differs only by the two expected API-httpx additions; offline no-build API export succeeds; git diff --check passes. A full packaged uv lock --check --no-build cannot run because uv requires local project metadata preparation. A temporary nonpackaged check also encounters unavailable offline atomicwrites candidates. No dependency/image builds, installation, inference or provider actions were performed. The Dockerfile is an unbuilt source recipe, not runtime or confidential-computing qualification.

Stacked on current PR #35 (5dec495ede145980bed22b94851e71007d85386b), including its PR #36 baseline/content-integrity repairs and reviewed Flow prompt_cache_key support. Head 2d08f31aa58c2c7b49304d0367ab51ae9aaccb11 merges that base while preserving original source commit 0e6e46395da101a0364db99fad0c5c2f3352a4e9; both changed files remain byte-for-byte identical to that commit. Committed LF lock SHA-256: 5348107dfc88034c60197d03379dac789cafd2b97e12cce1577c6c2ea14d5fb5. This Windows CRLF checkout hashes to 54ba11d2ca844c0d995aae9f983b4770a8a41cd6a4313618f7b4fb68658749ae.

Historical validation at a30a95ce53e4a1eeb3242d2326d2fe1632f2f222: Ubuntu and macOS Python 3.12 tests pass (Tests run); Black and isort pass (Style run). The researcher reported no scoped source blocker at that head after an independent read-only inspection of the two-file diff. These checks do not build or qualify the runtime image.

Latest head 2d08f31aa58c2c7b49304d0367ab51ae9aaccb11 incorporates the PR35 packaging integrity repair without rewriting history. The two-file diff and original lock/recipe blobs remain unchanged; Ubuntu and macOS Python 3.12 tests pass (Tests run); Black and isort pass (Style run). This current-head CI does not establish runtime image, provider or confidential-computing qualification.