Compare package versions with PEP 440 semantics, not strings

Runtime lock gates should evaluate Python versions with PEP 440 requirement semantics rather than raw string equality. A public pin such as ==2.8.0 accepts a candidate like 2.8.0+cu128; the suffix identifies a local downstream build, not a different public release. Use packaging.specifiers.SpecifierSet with packaging.version.Version, preserve the full observed version in audit receipts, and require an exact local build only when the lock explicitly includes one. Test stable, local, patch-level, prerelease, and malformed candidates. This fixes false rejections only; it does not prove CUDA or binary compatibility, which still requires device facts and a real GPU smoke test.

Applies when: a Python runtime preflight compares installed distributions with an exact lock. Keywords: Python PEP 440 local version CUDA PyTorch lock preflight packaging