fix(workspace/deps): pin python-multipart>=0.0.27 for chat-upload Starlette parser

Add python-multipart to the PYPROJECT_TEMPLATE dependencies in
scripts/build_runtime_package.py — the actual SSOT for
molecule-ai-workspace-runtime's PyPI dist (not the sibling repo's
pyproject.toml, which is regenerated from this template on every
runtime-v* tag push per publish-runtime.yml).

Root cause (forensic a78762a0, 2026-05-19): Hermes workspace PDF upload
returned opaque 400 "failed to parse multipart form" because the
published PyPI runtime (0.1.17) lacks python-multipart. Without it,
Starlette's Request.form() raises AssertionError on multipart bodies,
which /internal/chat/uploads/ingest surfaces as a 400.

workspace/requirements.txt already pins this (Dependabot PR #2526
landed it months ago for the monorepo Docker image), but the PyPI
build path bypasses workspace/requirements.txt entirely — it uses the
hardcoded PYPROJECT_TEMPLATE on line 253. That divergence is the bug.

Class drift note: workspace/requirements.txt and the PyPI deps list
are two separate manifests with no enforced parity. A follow-up RFC
should consider either (a) having build_runtime_package.py derive
deps from workspace/requirements.txt, or (b) a lint that asserts the
two are aligned. Out of scope for this P0 fix.

Companion: workspace-runtime#18 was correctly rejected by mirror-guard
(direct edits to the mirror are reverted by the next publish). That
PR is closed in favor of this one.

Verification path after merge:
  1. Tag runtime-v0.1.18 on main (or trigger publish-runtime-autobump).
  2. publish-runtime.yml builds wheel via build_runtime_package.py →
     pyproject.toml now contains python-multipart>=0.0.27.
  3. twine uploads to PyPI; cascade fans out .runtime-version to
     templates including Hermes.
  4. Restart Chloe-Hermes workspace; retry PDF upload via canvas.
  5. Expect HTTP 200 with {"files":[{"uri":"workspace:/...",...}]}.

Refs: a78762a0, workspace-runtime#18, feedback_check_vendor_docs_and_actual_source_before_guess_api_shape

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/build_runtime_package.py

@@ -256,6 +256,13 @@ dependencies = [
     "uvicorn>=0.30.0",
     "starlette>=0.38.0",
     "websockets>=12.0",
+    # multipart/form-data parser — required for Starlette's Request.form() on
+    # /internal/chat/uploads/ingest. Without it, Starlette raises AssertionError
+    # when parsing multipart bodies, which the chat-upload handler surfaces as
+    # an opaque 400. Mirrors the canonical pin in workspace/requirements.txt;
+    # >=0.0.27 avoids CVE-2024-53981 (DoS via malformed boundary).
+    # Forensic a78762a0 (2026-05-19): Hermes PDF upload 400 root cause.
+    "python-multipart>=0.0.27",
     "pyyaml>=6.0",
     "langchain-core>=0.3.0",
     "opentelemetry-api>=1.24.0",