bug(deploy): the AI stack's constraint path is not rewritten on deploy — pip looks for /constraints/shared.txt and provisioning fails #14272

What happens

A live provisioning run fails at the AI stack:

TASK [ai-stack : Install AI Python packages from requirements-ai.txt]
ERROR: Could not open constraint file:
  [Errno 2] No such file or directory: '/constraints/shared.txt'

Why

autobot-infrastructure/shared/docker/ai-stack/requirements-ai.txt:25 carries

-c ../../../../constraints/shared.txt

which is correct in the repo — four levels up from
autobot-infrastructure/shared/docker/ai-stack/ is the repo root.

The ai-stack role plain-copies that file to {{ ai_install_dir }}/requirements-ai.txt
(roles/ai-stack/tasks/main.yml:~197) and pip-installs it in place. From
/opt/autobot/autobot-ai-stack/, four levels up is /, so pip looks for
/constraints/shared.txt and finds nothing. The path is not rewritten and
constraints/shared.txt is not deployed anywhere.

This is already solved once, for a different role

scripts/build-filtered-requirements.sh exists precisely for this, and its own header says so:

Rewrites the sibling-relative -c ../constraints/... include to the canonical code_source
path, which always exists as the git checkout on deploy targets (#11117). Without this, pip
errors on the missing constraint file.

The backend role and services/role_registry.py both call it. The ai-stack role does not — it
was never wired in. Same defect the script was written to fix, in a role nobody revisited.

Two things block simply reusing it:

1. Its sed matches ^-c \.\./constraints/ — exactly two dots. The ai-stack file needs four
   levels, so the pattern would not match even if the script were invoked.
2. The ai-stack role has no code_source_dir (0 references), so it has nothing to rewrite to yet.

Fix

• Make the rewrite depth-agnostic: any number of ../ before constraints/ (and the same
  for -r). A pattern that only handles the one depth it was written against is the reason
  this did not transfer.
• Invoke the canonical script from the ai-stack role instead of copying the file raw —
  consolidate, do not add a second rewrite.
• A guard test: every requirements file that is deployed to a different depth than it lives
  at must go through the rewrite. Grep the deploy sites, not the script's name, or the next
  role added is the next incident.

Acceptance criteria

• A provisioning run installs the AI stack requirements with the shared pins applied — not
  merely "does not error", since dropping the constraint silently would also not error.
• The rewrite is exercised at more than one ../ depth in a test.
• Host evidence from a real run, not a merged diff.

Notes

The run reached node_00_SLM_Manager: ok=360 before this, well past #14226 (ok=31) and #14228
(ok=218), so the earlier provisioning fixes are holding.