Pin anthropic below 1.0 and guard the SDK call contract

[MaxGhenis]

Every PR's Test job started failing on 2026-08-21 with AttributeError: module 'anthropic' has no attribute 'HUMAN_PROMPT' (example run on #3798). Root cause: anthropic 1.0.0 was released 2026-08-20 19:58 UTC and removed the legacy Text Completions constants and the temperature/top_p/top_k keywords from messages.stream()/create(); anthropic was unpinned in pyproject.toml.

Two install surfaces float: the PR Test job, and — more importantly — the Cloud Run production image (gcp/cloud_run/Dockerfile runs plain pip install -e . and uv.lock is dockerignored). The last production build was 2026-08-19 18:24 UTC, before 1.0.0 existed; the next master merge would ship anthropic 1.0.0, and ai_analysis_service.py:68-74 (temperature=0.0 → claude_client.messages.stream(...)) would raise TypeError. Mocked unit tests cannot see this: the fakes accept arbitrary kwargs.

Changes (no runtime behavior change)

• pyproject.toml: anthropic>=0.97.0,<1 (pip resolves 0.99.0; uv.lock stays 0.97.0 — both keep temperature and HUMAN_PROMPT, verified by introspecting the real Messages.stream signature on 0.97.0, 0.99.0 and 1.0.0).
• tests/unit/services/test_anthropic_sdk_contract.py: asserts the installed SDK's Messages.stream accepts temperature and that the major version is <1, so the next SDK break fails CI loudly instead of passing through mocks.
• No prompt, cache-key, or service code changes.

Verification

• tests/unit/services: 374 passed under the lock (0.97.0); the analysis tests and the contract test pass under 0.99.0; the contract test fails as designed under 1.0.0.
• Two cross-family (Sol) review rounds shaped this: round 1 caught the temperature removal and the unpinned production image; round 2 caught that a prompt cleanup in the earlier revision would have invalidated AI-analysis caches — that change was dropped so this PR is pin-only.

Found en route, tracked separately

AI_ANALYSIS_MODEL = "claude-sonnet-4-20250514" is retired: the Models API returns 404 not_found_error for it (and for claude-sonnet-4-0), so the AI-analysis cache-miss path already fails in production today. That needs a model decision and its own PR; see the linked issue.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.11%. Comparing base (e3384bd) to head (f45a7ab).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3799   +/-   ##
=======================================
  Coverage   85.11%   85.11%           
=======================================
  Files         109      109           
  Lines        6290     6290           
  Branches     1093     1093           
=======================================
  Hits         5354     5354           
  Misses        630      630           
  Partials      306      306           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.