chore(release): openadapt-flow 2.4.1 - #1620

… 3.10 environments

Main changed packages/flow/uv.lock (#1596, #1620) after this branch did, and
git merged the two edits without a conflict into a lock uv cannot parse:
"Dependency onnxruntime has missing source field but has more than one
matching package". This takes main's lock and relocks it with the merged
pyproject, so it gains only the Python 3.10 fork (onnxruntime 1.23.2).

#1572 merged after the 2.4.1 version bump (#1620) and before 2.4.1
published, so it ships in 2.4.1. This adds its changelog line and
regenerates llms-full.txt.

… lands (#1622)

* fix(flow): record a held save's result, not the screen before it lands

The recorder took a click's after-frame once the screen settled, and its
system-of-record read with it. While the agent guard holds a save for its
checks the screen holds still too, so on a loaded runner the frame settled
and the record was read before the write landed. The save step then showed
no new record, compile emitted a placeholder effect, and admission refused
the taught program: "no canary ran: a write step lacks an independent
read-back: step_005: record_written is placeholder". It failed
tests/e2e/test_agent_guard_e2e.py on a 4-core CI runner and passed locally
and on main's own run.

Holding the save 2 s in the guard's process reproduces it exactly (empty
sor_after on the save event, the same admission error). NetworkCapture now
counts writes in flight (any method but GET, HEAD or OPTIONS, from the
browser's request to its finish or failure), and the recorder waits for
them, up to 30 s and pumping Playwright, before a click's after-frame and
before each record read.

tests/e2e/test_agent_guard_slow_hold_e2e.py holds every guarded save 2 s
and requires the recording to show the write and the program to be
admitted; it fails without this change. tests/test_recorder_waits_for_writes.py
covers the in-flight count and the bounded wait.

* ci: lock installable on Python 3.10, check every lock's oldest Python, four PR shards

Main went red at 0feec0f: agent shim (py3.10) and Python CI (3.10) could
not install onnxruntime 1.24.3, which publishes no cp310 wheel and no sdist,
yet the root, Agent and Flow locks pinned it for Python 3.10. The pull-request
lane runs 3.12, so only main's 3.10 jobs saw it.

- The root, Agent and Flow projects set uv's required-environments to Python
  3.10 on Linux, macOS and Windows. Their locks now pin onnxruntime 1.23.2
  for 3.10 and keep 1.24.3 and 1.27.0 for 3.11 and up.
- scripts/ci/check_lock_wheels.py resolves every lock's pins for its
  requires-python floor on the runners' platforms (no install). The ci smoke
  job runs it, so a lock like this fails the pull request. It fails on
  main's old locks with the onnxruntime error and passes on all ten now.
- Four Flow unit shards on pull requests, six benchmark files to nightly
  whole (this commit missed #1608's merge).
- The nightly run's Flow shards take all of tests/e2e; flow-critical also
  runs the new slow-hold guard test.

* fix(flow): wait only for this recording's writes, briefly, and never past the next action

An adversarial review of the in-flight write wait found three ways it could
stall a recording attached to a person's browser, where the context holds
every tab:

- Another tab's long-poll POST counted as pending, so each event waited the
  full 30 s, and a click waited twice. Only writes from the pages the
  recording follows count now.
- A request whose finish Playwright never reports (a beacon from a popup that
  closes) stayed pending for the rest of the recording. The wait covers only
  the writes in flight when it starts, each for at most 30 s since it was
  sent.
- An action that arrived during the wait made the recording abort. The wait
  ends as soon as the next action is queued.

The click's after-frame now settles first (its screenshots deliver the
save's request event) and settles again once a write it waited for has
landed, so the frame and the record read agree. The wait runs on the start
tab, as the pump does, because a followed popup may close by itself.

None of the review's findings recorded a wrong contract that looks verified:
each failed closed or slowed the recording. The new unit tests cover each
one; both agent guard e2e tests pass, the slow-hold one included.

* fix(flow): rebuild uv.lock on main's (2.4.1, grounding rung) with the 3.10 environments

Main changed packages/flow/uv.lock (#1596, #1620) after this branch did, and
git merged the two edits without a conflict into a lock uv cannot parse:
"Dependency onnxruntime has missing source field but has more than one
matching package". This takes main's lock and relocks it with the merged
pyproject, so it gains only the Python 3.10 fork (onnxruntime 1.23.2).

* test(flow): check the slow-hold run's compiled recording, and say why it is missing

In CI the guard's run-1 recording was not at run-ok/recording when the test
read it, though the run was clean and the save held 2 s. The test now reads
the recording the handoff kept and compiled (<task_dir>/program/recording),
which is the evidence that matters, and fails with the guard's notes, error
and handoff when it is missing. PYTHONPATH is prepended to, not replaced.

* ci: run the slow-hold guard test nightly, not in flow-critical

On CI the slow-hold test's run 1 was refused by the recorder ("more than one
logical browser action arrived before Flow could retain an exact intermediate
frame"), which passes locally and fails closed. It stays in tests/e2e, which
the nightly run covers, while that is pinned down separately; flow-critical
keeps test_agent_guard_e2e, which passes with the recorder fix.