Fix: honor pinned constraints in pip install recipes (#70)

[jensens]

Summary

• Introduces a single lazy-evaluated PIP_CONSTRAINTS_FLAG Makefile variable in core/mxenv.mk that resolves to -c constraints-mxdev.txt when present, falls back to the user's constraints.txt, and is empty otherwise.
• Routes every pip install recipe across the topic templates through this flag and drops -U.
• Resolves make install ignores pinned constraints, upgrades transitive deps unexpectedly #70 — make install no longer silently upgrades transitive deps past project pins.

Why

sphinx-autobuild, coverage, and other tool installs ran with pip install -U <pkg> and no -c <constraints>, so transitive deps (e.g. starlette, uvicorn, websockets) were pulled to latest even when pinned in constraints.txt. Local venvs diverged from CI builds, breaking reproducibility for projects that rely on pin discipline.

The fix uses lazy expansion (= not :=) so \$(wildcard …) re-evaluates per use — the same recipe correctly resolves whether mxfiles has run yet or not. No domain-graph reordering needed.

Scope

• src/mxmake/topics/core/mxenv.mk — flag definition + bootstrap installs
• src/mxmake/topics/docs/sphinx.mk
• src/mxmake/topics/qa/{coverage,ruff,black,isort,mypy,pyrefly,pyupgrade,test,ty,zpretty}.mk
• src/mxmake/topics/applications/{cookiecutter,twisted,zest-releaser}.mk
• src/mxmake/topics/i18n/lingua.mk
• src/mxmake/topics/ldap/python-ldap.mk
• src/mxmake/topics/core/packages.mk — added a comment noting that constraints are already embedded in requirements-mxdev.txt (so this recipe is intentionally untouched)
• src/mxmake/tests/expected/Makefile — snapshot updated to lock the post-fix output
• Makefile — regenerated via dogfood mxmake update
• CHANGES.md — 2.2.1 entry
• docs/source/migration.md — 2.2.1 behavior-change section

Test plan

• pytest src/mxmake/tests/ — 32 passed
• make install against regenerated Makefile — clean run
• make test && make check && make typecheck — all green
• grep -rn "install -U" src/mxmake/topics/ — no matches
• Every pip install <pkgs> recipe in topics now passes \$(PIP_CONSTRAINTS_FLAG)
• Reviewer-side: in a downstream FastAPI/Starlette project, pin starlette/uvicorn/websockets in constraints.txt, run mxmake update && make clean install, confirm pip freeze matches the pins