Add unit tests for update_cicaid_pins.py in the cicaid-pro generator repo

What

Add unit tests for the update_cicaid_pins.py script in the cicaid-pro generator repository. The script is scaffolded by cicaid setup-review-actions and handles parsing, version comparison, and file updates for dependency pinning.

Why

The script is stdlib-only by design and contains non-trivial logic for parsing, version comparison, and file updates. Currently, there is no test coverage for this script, which creates correctness risk as the script evolves. The update-cicaid.yml workflow includes an integration test (the "Install dependencies from the updated pin" step), but unit tests would provide faster, more targeted feedback on the script's logic without requiring a full workflow run.

How

1. Create a test file (e.g., test_update_cicaid_pins.py) in the appropriate test directory of the cicaid-pro generator repo.
2. Write tests covering:
   • Parsing of dependency pin files (valid and malformed input)
   • Version comparison logic (e.g., handling of [A-Za-z0-9._+-]+ version patterns)
   • File update behavior (correct replacement of pins, handling of missing dependencies)
   • Error handling for network failures (OSError, ValueError, and urllib.error.HTTPError which is a subclass of OSError)
   • Edge cases: empty files, missing dependencies, unexpected version formats
3. Use Python's built-in unittest or pytest (matching the repo's existing test conventions).
4. Mock network calls (e.g., urllib.request.urlopen) to test the script's logic without external dependencies.

Files Affected

• test_update_cicaid_pins.py (new file, location to be determined based on repo structure)
• update_cicaid_pins.py (may need minor refactoring to improve testability, e.g., separating pure functions from I/O)

Constraints

• Must not break the existing cicaid setup-review-actions scaffolding behavior.
• Must not change the script's public interface or CLI behavior.
• Must not introduce external dependencies beyond what the repo already uses for testing.
• The integration test in update-cicaid.yml must continue to pass.
• Out of scope: refactoring the script to use gh api instead of urllib.request (suggested as a separate follow-up).

LLM tier

Sonnet — this requires moderate design judgment for structuring test cases and potentially refactoring the script for testability, but does not involve complex architectural decisions.

Success looks like

• Unit tests exist for update_cicaid_pins.py covering parsing, version comparison, file updates, and error handling.
• Tests pass locally and in CI.
• Test coverage includes edge cases (malformed input, missing dependencies, network errors).
• No changes to the script's behavior or interface.

Failure looks like

• Tests are superficial (e.g., only testing happy paths) and miss the script's core logic.
• Tests require network access or external services to run.
• The script is refactored in a way that changes its behavior or breaks the existing integration test in update-cicaid.yml.
• Tests are flaky or non-deterministic.

Follow-up from AI review of PR #3.