[Consumer Repos] Standardize dependency refresh workflows

[stranske]

Why

After fixing the dependency refresh workflow in PR #885, an audit revealed inconsistencies across consumer repos. Two repos need updates to ensure all optional dependencies are included in their lock files.

Scope

Fix dependency management in:

1. Travel-Plan-Permission - Convert to uv, include all extras (dev, ocr, orchestration)
2. Collab-Admin - Add missing dependency workflow

Ensure all 7 consumer repos have consistent, sustainable dependency management.

Non-Goals

• Changing dependency versions in pyproject.toml
• Modifying other workflows beyond dependency refresh
• Adding new dependency groups

Tasks

Travel-Plan-Permission

• Convert from pip-compile to uv pip compile
• Include all extras: --extra dev --extra ocr --extra orchestration
• Remove requirements-dev.lock (consolidate to single file)
• Update workflow structure to match Workflows repo template

Collab-Admin

• Add .github/workflows/maint-dependabot-auto-lock.yml
• Configure for --extra dev (only extra in that repo)
• Use Template repo workflow as base

Acceptance Criteria

• Travel-Plan-Permission uses uv and includes all 3 extras
• Collab-Admin has automated dependency refresh workflow
• All 7 consumer repos use consistent tooling (uv)
• All repos include ALL their optional extras in lock files

Implementation Notes

Current Status:

✅ Already Correct (5 repos):

• Template - --extra dev ✓
• trip-planner - --extra dev ✓
• Manager-Database - --extra dev ✓
• Trend_Model_Project - all extras included ✓
• Portable-Alpha-Extension-Model - all extras included ✓

❌ Need Fixes (2 repos):

• Travel-Plan-Permission - uses pip-compile, missing extras
• Collab-Admin - no workflow

Travel-Plan-Permission Changes:

Files to modify:

• .github/workflows/maint-51-dependency-refresh.yml

Files to delete:

• requirements-dev.lock

Update compile command:

uv pip compile --upgrade pyproject.toml --extra dev --extra ocr --extra orchestration -o requirements.lock

Collab-Admin Changes:

Files to create:

• .github/workflows/maint-dependabot-auto-lock.yml

Use standard template with:

uv pip compile pyproject.toml --extra dev --universal --output-file requirements.lock

Reference:

• Workflows repo: .github/workflows/maint-51-dependency-refresh.yml
• Template repo: .github/workflows/maint-dependabot-auto-lock.yml
• Related: PR fix: include all optional extras in dependency refresh workflow #885

Related Issues:

• Travel-Plan-Permission fix: prevent blank checkboxes from HTML comments in PR bodies #412
• Collab-Admin fix: checkout Workflows scripts in reusable-codex-run.yml #190

[github-actions]

🏷️ Label Suggestions

Based on the issue content, these labels might be relevant:

• feature (90% confidence)
• enhancement (90% confidence)
• workflows (95% confidence)
• status:in-progress (95% confidence)
• status: ready (95% confidence)
• phase-1 (95% confidence)
• health:repo (95% confidence)
• github:actions (95% confidence)
• dependencies (95% confidence)
• automated (95% confidence)
• agents:auto-pilot-pause (95% confidence)
• agents:auto-pilot-failed (95% confidence)

Auto-applied: agents:auto-pilot

How to use these suggestions

• Click the label name in the sidebar to add it
• Or use the GitHub CLI: gh issue edit 888 --add-label "label-name"

---

Auto-generated by label matcher

[stranske]

All acceptance criteria verified complete:

✅ Travel-Plan-Permission

• Converted to uv pip compile
• Includes all extras: --extra dev --extra ocr --extra orchestration
• requirements-dev.lock removed (consolidated to single file)

✅ Collab-Admin

• Added maint-dependabot-auto-lock.yml
• Configured with --extra dev

✅ All 7 consumer repos now use consistent uv tooling with all their optional extras included.

[github-actions]

🤖 Auto-pilot: Issue closed but couldn't find linked merged PR.

Adding verify:evaluate label to issue for tracking.