Versioning lock refresh fails under an unpinned uv release #521

The push workflow Versioning job (run 34962073254, the 6.0.0 release after #515) failed at python scripts/release_lock.py --refresh: "Versioning changed the reviewed dependency graph; prepare and review the lock before release".

Cause: setup-uv@v8.1.0 installs the latest uv (0.12.14 on 2026-09-15). With a cold cache, that uv rewrites two dependency-edge markers in uv.lock (cffi -> pycparser loses implementation_name != 'PyPy'; pexpect -> ptyprocess loses sys_platform != 'emscripten' and sys_platform != 'win32'), so the post-bump lock differs from the reviewed lock beyond the root version and the strict refresh fails closed. uv lock --check accepts either form, which is why the PR checks passed. Reproduced locally: uv 0.11.7 keeps the markers; uv 0.12.14 with --refresh drops them and is idempotent afterwards.

Fix: pin the uv release in every setup-uv step so the release path resolves with one known resolver, and regenerate uv.lock with that same uv in a reviewed PR so the Versioning refresh changes only the root version.