fix: pin opencv-python-headless to the resolved opencv-python version

Capture the exact version from uv pip show before uninstalling, so the
headless variant matches what the resolver chose for rapidocr.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: eoinfennessy

Containerfile

@@ -8,10 +8,12 @@ COPY distribution/constraints.txt ${APP_ROOT}/constraints.txt
 COPY distribution/requirements.txt ${APP_ROOT}/requirements.txt
 
 # Package docling transitively pulls in opencv-python via rapidocr.
-# opencv-python requires libGL.so.1 (absent in UBI). Swap it for the headless variant after install
+# opencv-python requires libGL.so.1 (absent in UBI). Swap it for the headless
+# variant after install, pinned to the exact version the resolver chose.
 RUN uv pip install --constraint ${APP_ROOT}/constraints.txt -r ${APP_ROOT}/requirements.txt \
+    && OPENCV_VERSION=$(uv pip show opencv-python 2>/dev/null | awk '/^Version:/{print $2}') \
     && uv pip uninstall opencv-python \
-    && uv pip install opencv-python-headless
+    && uv pip install --constraint ${APP_ROOT}/constraints.txt "opencv-python-headless==${OPENCV_VERSION}"
 
 COPY distribution/fetch_artifacts.py ${APP_ROOT}/fetch_artifacts.py
 COPY --chmod=755 distribution/copy-artifacts.sh ${APP_ROOT}/copy-artifacts.sh

Containerfile.in

@@ -6,10 +6,12 @@ COPY distribution/constraints.txt ${APP_ROOT}/constraints.txt
 COPY distribution/requirements.txt ${APP_ROOT}/requirements.txt
 
 # Package docling transitively pulls in opencv-python via rapidocr.
-# opencv-python requires libGL.so.1 (absent in UBI). Swap it for the headless variant after install
+# opencv-python requires libGL.so.1 (absent in UBI). Swap it for the headless
+# variant after install, pinned to the exact version the resolver chose.
 RUN uv pip install --constraint ${APP_ROOT}/constraints.txt -r ${APP_ROOT}/requirements.txt \
+    && OPENCV_VERSION=$(uv pip show opencv-python 2>/dev/null | awk '/^Version:/{print $2}') \
     && uv pip uninstall opencv-python \
-    && uv pip install opencv-python-headless
+    && uv pip install --constraint ${APP_ROOT}/constraints.txt "opencv-python-headless==${OPENCV_VERSION}"
 
 COPY distribution/fetch_artifacts.py ${APP_ROOT}/fetch_artifacts.py
 COPY --chmod=755 distribution/copy-artifacts.sh ${APP_ROOT}/copy-artifacts.sh