pre-commit is under-determined

[d-v-b]

in #3619 I observed that the pre-commit check that runs in CI was flagging different problems from my local pre-commit run. This is no fun for contributors. I suspect we are leaving some versions of python + deps open, when we should instead declare them explicitly.