[netopsengineer]

Summary

• Replace every hardcoded uv 0.11.29 bootstrap with the single Dependabot-owned uv==0.13.4 requirement and matching hashed uv.lock entry, addressing GHSA-hq85-5cpj-mr62.
• All six setup-uv steps and the semantic-release hook consume the same lock. The audit proves the installed executable matches it before scanning, and existing inventory checks now require bootstrap coverage.
• Add regression tests for missing/duplicate/ranged/mismatched pins, installed-version drift, omitted scan coverage, and the vulnerable bootstrap rejection. Scanner errors, permissions, required checks, malware checking and the empty exception policy remain unchanged.
• Add a concrete dependency release-impact checklist to the existing PR template and documentation. Correct the misleading assumption that a tooling-only commit can never release earlier accumulated changes.

Verification

• uv sync --locked: passed.
• Full uv run prek run --all-files --show-diff-on-failure: passed, including lint/format, pyright, pydoclint, Bandit, gitleaks, actionlint and zizmor.
• pytest: 680 passed; 100% line and branch coverage, including the new bootstrap validator.
• Live uv 0.13.4 audit: all 21 registry packages, zero vulnerabilities, zero adverse statuses; original fail-closed policy accepted the report with zero exceptions.
• Candidate uv build --no-sources: wheel and sdist built; clean wheel installation and all four documented invocation forms passed. Wheel has no Requires-Dist, no uv executable and no shim module. Source archive has the expected build-backend metadata.
• Independent local diff review found no security/control regressions.
• Supplemental Sourcery review was not run: it requires uploading repository source/tests to api.sourcery.ai, and that disclosure was not authorized. No bypass/workaround attempted. No authenticated live Claude E2E was run; this PR does not publish a release or change runtime code.
• Docker is unavailable locally, so the real OSV CLI gate is verified by required CI rather than claimed as a local pass.

Dependency release impact

• Surface: CI/development/release bootstrap, not installed runtime. Both main and published 0.2.6 have no runtime dependencies; src/skill_optimizer is unchanged since v0.2.6.
• Actual published wheel/sdist inspected independently: wheel has no Requires-Dist; sdist requires uv_build>=0.11.28,<0.13. Current source permits <0.14 after chore: update uv-build requirement from <0.13,>=0.11.28 to >=0.11.28,<0.14 #81. uv_build is a different package from the vulnerable uv executable.
• Pinned python-semantic-release 10.7.0 read-only full-history analysis on main 58d647a found 46 unreleased commits, all NO_RELEASE: 'No release will be made, 0.2.6 has already been released!' No tree/tag/HEAD changes.
• Decision: no runtime distribution needed for this bootstrap remediation. A separate deliberate source release is needed only to deliver the already-merged build-backend compatibility-range change to PyPI source-install users. No release/tag/publication is requested here; retain the ci: squash title and recheck accumulated history before merge.