pyamber 3.12 license check fails on every PR after joblib un-vendored cloudpickle #8292

What happened?

build / pyamber (ubuntu-latest, 3.12) went red repo-wide on 2026-08-31, on
every open PR, whatever the PR touches. The failing step is Check installed
Python packages against per-module LICENSE-binary files (it runs on the 3.12
leg only; 3.11 and 3.13 skip it), and the whole failure is one line:

NEW Python packages not claimed by LICENSE-binary:
  + cloudpickle==3.1.2  (license: BSD License) -> add to amber/LICENSE-binary-python

Root cause is upstream, not in any PR: joblib 1.6.0 stopped vendoring
cloudpickle.

amber/operator-requirements.txt reaches joblib transitively, so pip now
installs cloudpickle as a distribution of its own:

operator-requirements.txt -> scikit-learn==1.7.2 -> joblib>=1.2.0 -> cloudpickle>=3.0

Before:  any PR -> pyamber 3.12 -> "+ cloudpickle==3.1.2"                     -> red
After:   any PR -> pyamber 3.12 -> "OK: 110 Python packages match ..."        -> green

It is time-based, not PR-based:

Two notes on reading the log:

• The long DRIFT (transitive, informational) list under the + line is not
  fatal. PR runs pass --ignore-transitive-version, and the nightly exact-match
  check on main owns refreshing those pins. It should not be bulk-bumped here.
• A sibling matrix leg reports cancelled (3.13 on feat(sql): remove superseded manual update scripts 01-22 #7703, 3.11 on
  ci/8084-...). That is fail-fast collateral, not a second failure.

cloudpickle 3.1.2 is BSD-3-Clause -- its wheel METADATA says
License: BSD-3-Clause, and PyPI's classifier reports only the generic
BSD License that shows up in the CI line. That is ASF Category A, the wheel
ships no NOTICE, and licenses/LICENSE-BSD-3-Clause.txt already carries the
text, so one bullet in amber/LICENSE-binary-python is the entire fix.

How to reproduce?

Any PR against main shows it. To reproduce the check itself without a full
pip install, rebuild the manifest's claimed set at the versions CI actually
installed and feed it to the checker:

python bin/licensing/check_binary_deps.py --ignore-transitive-version python /tmp/pip-licenses.csv

where /tmp/pip-licenses.csv is Name,Version,License rows for every
- name==version bullet in amber/LICENSE-binary-python, plus
cloudpickle,3.1.2,BSD License. It exits 1 with the + cloudpickle==3.1.2
line above; adding the bullet makes it exit 0 with
OK: 110 Python packages match LICENSE-binary.

To confirm the upstream cause directly:

pip download joblib==1.5.3 --no-deps -d . && pip download joblib==1.6.0 --no-deps -d .
# unzip each; 1.6.0's METADATA has `Requires-Dist: cloudpickle>=3.0`
# and no joblib/externals/cloudpickle/ directory.

Version/Branch

1.3.0-incubating-SNAPSHOT (main)