build(toolchain): bump anyscale CLI to 0.26.107 for k8s clouds

[elliot-barn]

Why

Before 0.26.107, workspace_v2 run_command was unconditionally legacy port-22 SSH:

host_name, config_file = self.generate_ssh_config_file(id=workspace_model.id)
return subprocess.run(["ssh"] + ANYSCALE_WORKSPACES_SSH_OPTIONS
                      + ["-F", config_file, host_name, command], ...)

Port 22 is unreachable on Kubernetes clouds (AKS/EKS/GKE). 0.26.107 prefers the HTTPS/WebSocket tunnel (wss://<host>/sshws).

Observed on an Azure AKS workspace with the old pin — every run_command fails, the CLI exits 0 anyway, and the template's tests silently never run:

>>> anyscale workspace_v2 run_command --name <ws> unzip -o workspace-intro.zip
ssh: connect to host 20.3.70.145 port 22: Connection timed out
>>> anyscale workspace_v2 run_command --name <ws> timeout 900 bash -c 'bash tests.sh'
ssh: connect to host 20.3.70.145 port 22: Connection timed out
Test completed successfully          ← reported as a pass

With 0.26.107 the same command against the same workspace connects and runs. VM clouds are unaffected (legacy SSH works there), so nothing currently green goes red.

What

• pyproject.toml: anyscale==0.26.99 → 0.26.107. scripts/test-pipeline/render-template-pipeline.sh reads the pin from here, so the Buildkite template-test pipeline picks it up.
• uv.lock regenerated with uv lock, per the pyproject header and because premerge runs uv sync --frozen.
• .claude/skills/template/references/run-tests-locally-with-rayapp.md: stale 0.26.87 → 0.26.107. Not wired to anything, but it's what a contributor copy-pastes when running rayapp by hand.

Testing

• uv lock --check clean — the lock matches pyproject, which is what uv sync --frozen enforces in premerge.
• Verified the pipeline still parses the pin past the added comment: grep -oE 'anyscale==[0-9][0-9A-Za-z.+!-]*' pyproject.toml | head -1 | cut -d= -f3 → 0.26.107.
• pre-commit green.

Related

Necessary but not sufficient for testing templates on Kubernetes clouds — rayapp also assumes the VM layout (run_command starts in $HOME while push writes to the workspace working directory; bash -c doesn't source the ~/.bashrc where k8s workspaces declare PATH and ANYSCALE_*). See ray-project/rayci#496, which fixes the related "failing command reports success" bug. The same bump for the publish pipeline's copy of this pin is anyscale/product#42483.

🤖 Generated with Claude Code