readd --without-hashes for deployment and constrain rapidpe-rift

!1291 (merged) deployment needs --without-hashes since flower is installed from main

Also constraint rapidpe-rift < 0.6.0 (released today). No changes to our locked deps. Test against wheel fails with v0.6.0 (rapidpe-rift/rapidpe-rift-pipe#116 (closed)).