fix(ci): pin samples and python-sdk checkouts to last verified-green combination

[vishkaty]

The nightly conformance run has been red since 2026-07-01 (e.g. run 28839412863; last green was 2026-06-30, run 28418270435). Root cause: the workflow checks out samples@main and python-sdk@main unpinned, so any incompatible move in either repo breaks this repo's signal with no change here.

That is exactly what happened: exactly one commit landed in either checked-out repo between the last green nightly and the first red one — python-sdk 298c295 (#48, 2026-06-30). After it, the Flower Shop server no longer boots (ImportError: cannot import name 'Checkout' from 'ucp_sdk...ap2_mandate'), so every test file fails at "Start Flower Shop server". Same root cause as Universal-Commerce-Protocol/samples#118, where the unpinned editable path dependency breaks the documented human setup path.

This PR pins both checkouts to the combination the last green nightly actually ran (samples 74e66de, python-sdk f54858e), with comments documenting the provenance and the bump procedure.

Verification

• Local: full suite against the pinned combination — all 13 test files pass (exit 0).
• Local negative control: same layout with python-sdk@main — the server fails to boot with the ImportError above (the current nightly failure).
• CI: the identical diff running in my fork is green end-to-end: https://github.com/vishkaty/conformance/actions/runs/28897597473

Notes

• Deliberately minimal: restores the nightly signal today and deletes cleanly whenever the suite restructure mentioned in feat: update conformance suite for UCP 2026-04-08 #41 lands.
• If you'd rather keep samples tracking main and pin only python-sdk, happy to adjust — pinned-both is simply the exactly-reproduced green state.
• Possible follow-up (separate PR if useful): a second continue-on-error nightly job against both @main as an early-warning drift canary.

[vishkaty]

Conformance Tests still failed on this morning's push to main, after the #47 merge: https://github.com/Universal-Commerce-Protocol/conformance/actions/runs/28931312401 — red since Jul 1 (last green Jun 30).

[vishkaty]

#49 is the complementary half of this: it adapts the tests to the python-sdk move, while the pin here keeps main green between such moves — with unpinned sibling checkouts, any upstream push can turn the nightly red regardless of test correctness (still failing as of today's scheduled run; red since Jul 1). The two compose cleanly: land the adaptation, then pin to the SHAs it was verified against.

[vishkaty]

Last night's scheduled run is red again with a new incompatibility (TypeAliasType.__call__() got an unexpected keyword argument 'id') from the sdk's type-alias change (python-sdk#51) — distinct from the import failure python-sdk#29 fixed. samples#127 is adapting the samples server to the same change. The pin here addresses the class, so main stays green between exactly these adaptation windows.

[damaz91]

Thank you for helping here @vishkaty - we appreciate you flagging and proactively trying to fix the incompatibility between SDK, conformance and samples. I don't think pinning it's the right long-term solution, as we want conformance to be used to continuously validate the "main" revision of samples.

We'll try to do a better job in releasing updates for these 3 dependent repos in a more coordinated manner. I'm closing this one as we'll handle this fix in other PRs (like Universal-Commerce-Protocol/samples#127 and #50).

Looking forward to more contributions!