Pin dependencies and add CI on pull requests

Two related gaps found while writing the "coming back after a month"
runbook:

- requirements.txt/requirements-dev.txt had no version pins at all.
A fresh `pip install` any time in the future would silently grab
whatever's newest on PyPI, with no way to tell "my change broke this"
from "an unrelated dependency update broke this." Pinned every package
to the version this codebase is actually tested against, with a range
up to its next breaking boundary (next major for a stable package, next
minor for a 0.x one). playwright and duckduckgo_search are pinned
tighter (patch-only): playwright ships in lockstep with a specific
browser revision - a mismatch is a real failure mode we already hit and
worked around in tests/conftest.py - and duckduckgo_search has a history
of breaking changes between versions. pytest-asyncio (dev-only) is
pinned the same way, for the same reason: its event-loop-scope semantics
bit us once already this project (see the `browser` fixture's comment).
Verified by installing from a clean venv and confirming the resolved
versions match exactly and all 97 tests still pass.

- Nothing ran the test suite until a change was already merged to main -
deploy-to-hf.yml's `test` job only triggers on push to main. Added
.github/workflows/test.yml, running the same suite on every pull
request, so a change gets feedback before merge instead of only at
deploy time.

.github/workflows/test.yml

@@ -0,0 +1,33 @@
+name: Tests
+
+# Runs the suite on every pull request targeting main, so a change gets
+# feedback before merge instead of only at deploy time. deploy-to-hf.yml
+# runs its own copy of this same gate right before every push to the Space
+# (belt-and-suspenders: never trust a check that ran before the current
+# state existed, the same principle behind that workflow's
+# --force-with-lease push).
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: pip install -r requirements-dev.txt
+
+      - name: Install Playwright's Chromium
+        run: playwright install --with-deps chromium
+
+      - name: Run tests
+        run: pytest

requirements-dev.txt

@@ -1,7 +1,12 @@
 # Test-only dependencies. Install with:
 #   pip install -r requirements.txt -r requirements-dev.txt
 #   playwright install chromium   # if not already present on the machine
+#
+# See the pinning note at the top of requirements.txt - same policy here.
+# pytest-asyncio is pinned tighter (patch-only): its event-loop-scope
+# semantics have changed in ways that mattered to us before (see
+# tests/conftest.py's comment on the `browser` fixture).
 -r requirements.txt
 pytest>=8,<10
-pytest-asyncio>=0.24
-respx>=0.21
+pytest-asyncio>=1.4.0,<1.5
+respx>=0.23.1,<0.24

requirements.txt

@@ -1,10 +1,24 @@
-fastapi
-uvicorn
-pydantic
-playwright
-duckduckgo_search
-beautifulsoup4
-httpx
-lxml
-python-dotenv
-fastmcp>=3.0,<4
+# Pinned to the versions this codebase is actually tested against (see
+# CONTRIBUTING.md). Range = "current version, up to the next breaking
+# boundary" - the next major for a stable (>=1.0) package, the next minor
+# for a 0.x package (0.x minor bumps are semver's equivalent of a major).
+#
+# playwright and duckduckgo_search are pinned tighter (patch-only): playwright
+# ships in lockstep with a specific browser revision (a version mismatch is a
+# real, previously-hit failure mode - see tests/conftest.py's fallback
+# executable_path logic), and duckduckgo_search has a history of breaking
+# changes between versions.
+#
+# To bump a dependency: update the pin here, run `pytest`, and if you touch
+# playwright specifically, re-run the full suite including
+# tests/test_serp_playwright.py (it drives a real browser).
+fastapi>=0.141.1,<0.142
+uvicorn>=0.52.4,<0.53
+pydantic>=2.13.5,<3
+playwright>=1.62.0,<1.63
+duckduckgo_search>=8.1.1,<8.2
+beautifulsoup4>=4.15.0,<5
+httpx>=0.28.1,<0.29
+lxml>=6.1.2,<7
+python-dotenv>=1.2.3,<2
+fastmcp>=3.4.7,<4