ci: (managed beta) align bundled AWS boto3 w/ OpenHound dependency

deployments/aws-extension-bundle.md

@@ -68,11 +68,12 @@ Replace `main` with the OpenHound branch to build. Add
 extension changes, run again with the desired SHA and a new development version.
 
 Bundle preparation updates the AWS extension's OpenHound requirements to the
-selected OpenHound build version, regardless of the original version pins. Other
-requirements, including boto3, are preserved and resolved against the frozen
-OpenHound build environment. Incompatible requirements fail the build before the
-image tag is published to ECR; reconcile the dependency requirements before
-retrying.
+selected OpenHound build version, regardless of the original version pins. It
+also pins the extension's boto3 requirements to the SDK version already installed
+by OpenHound's frozen dependency sync, regardless of the original AWS bounds.
+The helper reads the installed version rather than hard-coding an SDK version.
+Other requirements are preserved. Dependency resolution and `uv pip check` still
+run before publication; unresolved conflicts fail the build.
 
 ## Deployment guidance
 

scripts/prepare_aws_bundle.py

@@ -16,29 +16,34 @@
 
 
 def patch_packaging(destination: Path, local_version: str) -> None:
-    """Select the local OpenHound build while preserving other AWS requirements."""
+    """Align AWS OpenHound and boto3 requirements with the frozen build environment."""
     metadata = destination / "pyproject.toml"
     document = tomlkit.parse(metadata.read_text())
     project = document.get("project", {})
     dependency_lists = [project.get("dependencies", [])]
     dependency_lists.extend(project.get("optional-dependencies", {}).values())
     dependency_lists.append(document.get("build-system", {}).get("requires", []))
     dependency_lists.extend(document.get("dependency-groups", {}).values())
-    selected_version = Version(local_version)
+    selected_versions = {"openhound": Version(local_version)}
     for dependencies in dependency_lists:
         for index, dependency in enumerate(dependencies):
             # Dependency groups may also contain include-group tables.
             if not isinstance(dependency, str):
                 continue
             requirement = Requirement(dependency)
-            if canonicalize_name(requirement.name) == "openhound":
+            name = canonicalize_name(requirement.name)
+            if name in {"openhound", "boto3"}:
+                if name not in selected_versions:
+                    selected_versions[name] = Version(version(name))
                 extras = (
                     f"[{','.join(sorted(requirement.extras))}]"
                     if requirement.extras
                     else ""
                 )
                 marker = f"; {requirement.marker}" if requirement.marker else ""
-                dependencies[index] = f"openhound{extras}=={selected_version}{marker}"
+                dependencies[index] = (
+                    f"{name}{extras}=={selected_versions[name]}{marker}"
+                )
     metadata.write_text(tomlkit.dumps(document))
     # Maturin's root-level include does not place the manifest inside the Python
     # package, where CollectorManager reads it via importlib.resources.