[verified] feat: pin native protobuf and gRPC generation

scripts/generate_native_protocol.py

@@ -20,6 +20,7 @@ already requires a toolchain and nothing is gained by committing them.
 from __future__ import annotations
 
 import argparse
+from importlib import metadata
 import pathlib
 import shutil
 import subprocess
@@ -38,15 +39,32 @@ REQUIRED_GRPCIO_TOOLS = "1.82.1"
 _HEADER = "# Generated by scripts/generate_native_protocol.py. Do not edit.\n"
 
 
-def _generate(into: pathlib.Path) -> None:
-    """Run protoc, writing generated modules into `into`."""
+def _require_grpcio_tools_version() -> None:
     try:
-        from grpc_tools import protoc
-    except ImportError:  # pragma: no cover - exercised only without the toolchain
+        actual = metadata.version("grpcio-tools")
+    except metadata.PackageNotFoundError:
         sys.exit(
             "grpc_tools is required to generate stubs:\n"
             f"    pip install grpcio-tools=={REQUIRED_GRPCIO_TOOLS}"
         )
+    if actual != REQUIRED_GRPCIO_TOOLS:
+        sys.exit(
+            "wrong grpcio-tools version for deterministic generation: "
+            f"found {actual}, require {REQUIRED_GRPCIO_TOOLS}\n"
+            f"    pip install --upgrade grpcio-tools=={REQUIRED_GRPCIO_TOOLS}"
+        )
+
+
+def _generate(into: pathlib.Path) -> None:
+    """Run the exactly pinned protoc, writing generated modules into `into`."""
+    _require_grpcio_tools_version()
+    try:
+        from grpc_tools import protoc
+    except ImportError:  # pragma: no cover - inconsistent/broken installation
+        sys.exit(
+            "grpcio-tools metadata exists but grpc_tools cannot be imported; reinstall it:\n"
+            f"    pip install --force-reinstall grpcio-tools=={REQUIRED_GRPCIO_TOOLS}"
+        )
 
     into.mkdir(parents=True, exist_ok=True)
     # grpc_tools bundles protoc and the well-known types, so generation needs no