Compare package versions with PEP 440 semantics, not strings
Runtime lock gates should evaluate Python versions with PEP 440 requirement semantics rather than raw string equality. A public pin such as `==2.8.0` accepts a candidate like `2.8.0+cu128`; the suffix identifies a local downstream build, not a different public…