ci: add task to run unittests with frozen deps

I think it makes sense to run the tests with both the "latest" dependencies,
and with the pinned dependencies that we package for releases.

Testing with latest can reveal changes/issues with new dep versions,
while testing with pinned is testing what users will actually run.
Previously we were only testing with "latest".

.cirrus.yml

@@ -1,13 +1,13 @@
+# unittests using the 'latest' runtime python-dependencies
 task:
   container:
     image: $ELECTRUM_IMAGE
     cpu: 1
     memory: 2G
   matrix:
-    - name: "unittests: python $ELECTRUM_PYTHON_VERSION"
+    - name: "unittests: py$ELECTRUM_PYTHON_VERSION"
       env:
         ELECTRUM_IMAGE: python:$ELECTRUM_PYTHON_VERSION
-        ELECTRUM_PYTHON_NAME: python3
       matrix:
        - env:
            ELECTRUM_PYTHON_VERSION: 3.10
@@ -17,7 +17,7 @@ task:
            ELECTRUM_PYTHON_VERSION: 3.12
        - env:
            ELECTRUM_PYTHON_VERSION: 3.13
-       - name: "unittests: python 3 debug mode"
+       - name: "unittests: py3.13, debug-mode"
          env:
            ELECTRUM_PYTHON_VERSION: 3.13
            # enable additional checks:
@@ -46,7 +46,7 @@ task:
     - export ELECTRUM_ECC_DONT_COMPILE=1
     - pip install ".[tests,qml_gui]"
   version_script:
-    - $ELECTRUM_PYTHON_NAME --version
+    - python3 --version
     - pip freeze --all
   pytest_script:
     - >
@@ -71,6 +71,49 @@ task:
   depends_on:
     - "linter: Flake8 Mandatory"
 
+# unittests using the ~same frozen dependencies that are used in the released binaries
+# note: not using pinned pyqt here, due to "qml_gui" extra
+task:
+  container:
+    image: $ELECTRUM_IMAGE
+    cpu: 1
+    memory: 2G
+  name: "unittests: py3.10, frozen-deps"
+  pip_cache:
+    folder: ~/.cache/pip
+    fingerprint_script: echo $ELECTRUM_IMAGE && cat contrib/requirements/requirements*.txt && cat contrib/deterministic-build/requirements*.txt
+  tag_script:
+    - git tag
+  libsecp_build_cache:
+    folder: contrib/_saved_secp256k1_build
+    fingerprint_script: sha256sum ./contrib/make_libsecp256k1.sh
+    populate_script:
+      - apt-get update
+      - apt-get -y install automake libtool
+      - ./contrib/make_libsecp256k1.sh
+      - mkdir contrib/_saved_secp256k1_build
+      - cp electrum/libsecp256k1.so.* contrib/_saved_secp256k1_build/
+  install_script:
+    - apt-get update
+    # qml test reqs:
+    - apt-get -y install libgl1 libegl1 libxkbcommon0 libdbus-1-3
+    - pip install -r contrib/deterministic-build/requirements-build-base.txt
+    - pip install -r contrib/requirements/requirements-ci.txt
+    # electrum itself:
+    - export ELECTRUM_ECC_DONT_COMPILE=1
+    - pip install -r contrib/deterministic-build/requirements.txt -r contrib/deterministic-build/requirements-binaries.txt
+    - pip install ".[tests,qml_gui]"
+  version_script:
+    - python3 --version
+    - pip freeze --all
+  pytest_script:
+    - pytest tests -v
+  env:
+    ELECTRUM_IMAGE: python:3.10
+    LD_LIBRARY_PATH: contrib/_saved_secp256k1_build/
+  depends_on:
+    - "linter: Flake8 Mandatory"
+
 task:
   name: "locale: upload to crowdin"
   container:
@@ -94,7 +137,7 @@ task:
     ELECTRUM_REQUIREMENTS_CI: contrib/requirements/requirements-ci.txt
     # in addition, crowdin_api_key is set as an "override" in https://cirrus-ci.com/settings/...
   depends_on:
-    - "unittests: python 3.10"
+    - "unittests: py3.10"
   only_if: $CIRRUS_BRANCH == 'master'
 
 task:
@@ -227,7 +270,7 @@ task:
     CIRRUS_WORKING_DIR: /opt/wine64/drive_c/electrum
     CIRRUS_DOCKER_CONTEXT: contrib/build-wine
   depends_on:
-    - "unittests: python 3.10"
+    - "unittests: py3.10"
 
 task:
   name: "build: Android (QML $APK_ARCH)"
@@ -261,7 +304,7 @@ task:
   binaries_artifacts:
     path: "dist/*"
   depends_on:
-    - "unittests: python 3.10"
+    - "unittests: py3.10"
 
 ## mac build disabled, as Cirrus CI no longer supports Intel-based mac builds
 #task:
@@ -324,7 +367,7 @@ task:
   env:
     CIRRUS_DOCKER_CONTEXT: contrib/build-linux/appimage
   depends_on:
-    - "unittests: python 3.10"
+    - "unittests: py3.10"
 
 task:
   container:
@@ -347,7 +390,7 @@ task:
       env:
         OMIT_UNCLEAN_FILES: 1
   depends_on:
-    - "unittests: python 3.10"
+    - "unittests: py3.10"
 
 task:
   name: "check submodules"