Three dependabot PRs landed on main in the last 4 days (#1-#5) without
cross-constraint checking. Two of them combined to break every deploy:

1. PR #3 bumped importlib-metadata 8.7.1 -> 9.0.0
2. PR #4 bumped opentelemetry-sdk to 1.41.1 but left opentelemetry-api
   at 1.41.0 (mismatched — the sdk requires the api at the same version)

Symptom: `make deploy` fails at the [BUILD] step with
"ERROR: Cannot install importlib-metadata==9.0.0 and mlflow-skinny==3.11.1
because these package versions have conflicting dependencies"

Discovered when attempting to redeploy feat/enterprise-proxy-registry
for security-fix verification. Reproduces on bare main — not specific to
the feature branch.

Resolution math:

  - mlflow-skinny 3.11.1 requires importlib_metadata>=3.7,<9
  - opentelemetry-api 1.41.x requires importlib-metadata>=6.0,<8.8.0

The opentelemetry constraint is the binding one: even bumping mlflow-skinny
to 3.12.0 doesn't help (it requires opentelemetry<=1.16, undoing the
otel bump). The only path that keeps the otel and mlflow versions on main
is reverting importlib-metadata to <8.8.

Changes:
  - requirements.txt: importlib-metadata 9.0.0 -> 8.7.1
  - requirements.txt: opentelemetry-api/proto 1.41.0 -> 1.41.1 (align with sdk)
  - pyproject.toml: declare `importlib-metadata<8.8` explicitly so
    dependabot won't try this bump again until upstream widens caps

Verified with `uv pip install --dry-run -r requirements.txt` — resolves
cleanly. Ready to deploy.

Co-authored-by: Isaac