Pin hishel<2 in the PDM 2.26.1+ bootstrap (#2028)

hishel 2.0.0 was published on 2026-11-05 at 14:10 UTC and removed
SyncSqliteStorage. PDM 2.26.9 and later declare an unbounded
`hishel>=1.0.0`, so a fresh bootstrap now resolves 2.0 and every
pdm command dies with "module 'hishel' has no attribute
'SyncSqliteStorage'". That turns the ci.yml e2e_vex_build leg
(pdm 2.29.2) red on every PR, and through ci-ok blocks every merge.

Pin `hishel<2` for 2.26.1+ in both the e2e harness and
scripts/backtest-pdm.py. For 2.26.1 - 2.26.8, which already bound
`<1`, the pin changes nothing. 2.21 - 2.26.0 keep `hishel<1`.


Claude-Session: https://claude.ai/code/session_011f9aeNshqCtBWV4tqKmmZ6

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs

@@ -136,6 +136,14 @@ fn pins_for(v: &str) -> Vec<String> {
         // 2.26.9+ require 1.x).
         if ((2, 21, 0)..(2, 26, 1)).contains(&t) {
             pins.push("hishel<1");
+        } else if t >= (2, 26, 1) {
+            // 2.26.9+ declare an unbounded `hishel>=1.0.0` (2.29.6:
+            // `>=1.4.0`), and hishel 2.0 (2026-11-05) dropped
+            // `SyncSqliteStorage`, so every command dies with "module
+            // 'hishel' has no attribute 'SyncSqliteStorage'". `<2`
+            // resolves the 1.x line those releases shipped against (a
+            // no-op for 2.26.1 - 2.26.8, which already bound `<1`).
+            pins.push("hishel<2");
         }
         // 2.x declares an unbounded `unearth`, and unearth 0.19 (2026-10-27)
         // moved to `httpx2`: PDM's PyPI client is no longer the `httpx`

scripts/backtest-pdm.py

@@ -204,6 +204,12 @@ def pins_for(version):
         # ModuleNotFoundError before locking.
         if (2, 21) <= v < (2, 26, 1):
             pins.append("hishel<1")
+        # 2.26.9+ declare an unbounded `hishel>=1.0.0` (2.29.6: `>=1.4.0`);
+        # hishel 2.0 (2026-11-05) dropped `SyncSqliteStorage` and every
+        # command dies with AttributeError. `<2` keeps the 1.x line (a
+        # no-op for 2.26.1 - 2.26.8, which already bound `<1`).
+        elif v >= (2, 26, 1):
+            pins.append("hishel<2")
         # 2.x declares an unbounded `unearth`; 0.19 (2026-10-27) moved to
         # httpx2 and breaks PDM's PyPI client ("PDMPyPIClient is not an
         # instance or subtype of type (Client)" on `pdm lock`, seen on