Raise the floor past CVE-2024-12797-affected wheels (43.x / 44.0.0). Add constraints.txt (exact 44.0.1) and requirements.lock.txt with sha256 hashes for cryptography and its runtime deps.
