packaging: stop exact-pinning build backends

Exact setuptools/wheel pins block platform-specific backend patches and
make isolated pip installs fail on Android/Termux Python. Keep a setuptools
lower bound only, drop the unused wheel backend pin, keep requirements.txt
aligned with core package deps, and install the Spaces extra in Docker
instead of pulling bitsandbytes by default.

Android/Termux is still not a supported runtime; the new platform note
documents host wheels, ANDROID_API_LEVEL, and --no-build-isolation so
pip does not isolate a second setuptools or compile manylinux-only
extensions.

tests/test_ci_policy.py

@@ -225,6 +225,28 @@ def test_ci_evidence_names_the_pull_request_head_not_the_synthetic_merge_commit(
     assert '--head-sha "$GITHUB_SHA"' not in workflow
 
 
+def test_build_backend_requirements_use_lower_bounds_not_exact_pins():
+    pyproject = (ROOT / "pyproject.toml").read_text(encoding="utf-8")
+    match = re.search(
+        r"(?ms)^\[build-system\]\n(?:#[^\n]*\n)*requires = \[([^\]]+)\]",
+        pyproject,
+    )
+    assert match is not None
+    requires = re.findall(r'"([^"]+)"', match.group(1))
+    assert requires
+    for requirement in requires:
+        spec = requirement.split(";", 1)[0]
+        name = re.split(r"[<>=!~]", spec, maxsplit=1)[0].strip()
+        assert name != "wheel", requirement
+        assert "==" not in spec, requirement
+        assert ">=" in spec, requirement
+        lower = re.findall(r">=([^,]+)", spec)
+        upper = re.findall(r"<=([^,]+)", spec)
+        assert not (
+            lower and upper and lower[0] == upper[0]
+        ), f"collapsed exact pin written as a range: {requirement}"
+
+
 def test_ci_runs_checkpoint_portability_contracts_on_windows():
     workflow = WORKFLOW.read_text(encoding="utf-8")
     checkpoint_job = workflow.split("  checkpoint-windows:\n", maxsplit=1)[1].split(

tests/test_jetson_support_tooling.py

@@ -217,6 +217,26 @@ def test_bitsandbytes_is_opt_in_for_quantization_only():
     assert extras["quantization"] == ["bitsandbytes>=0.46.1"]
 
 
+def test_requirements_txt_mirrors_core_pyproject_dependencies():
+    metadata = tomllib.loads((ROOT / "pyproject.toml").read_text())
+    requirements = [
+        line.strip()
+        for line in (ROOT / "requirements.txt").read_text().splitlines()
+        if line.strip() and not line.startswith("#")
+    ]
+
+    assert requirements == metadata["project"]["dependencies"]
+    assert not any(value.startswith("bitsandbytes") for value in requirements)
+    assert not any(value.startswith("gradio") for value in requirements)
+
+
+def test_dockerfile_installs_spaces_extra_not_quantization():
+    dockerfile = (ROOT / "Dockerfile").read_text()
+
+    assert 'pip install --no-cache-dir ".[spaces]"' in dockerfile
+    assert "bitsandbytes" not in dockerfile
+
+
 def test_jetson_issue_form_requires_reproducible_sanitized_hardware_evidence():
     form = yaml.safe_load(
         (ROOT / ".github" / "ISSUE_TEMPLATE" / "jetson-runtime.yml").read_text(),