.tool-versions(uv) uv 0.12.6 -> 0.12.9

why: 0.12.9 is a security release for uv's HTTP client, which is the
code path every `uv lock` and `uv sync` in this repository runs.
Sensitive headers are now stripped when a redirect crosses an
authentication realm, including same-host redirects that only change
the URL scheme, and `async_http_range_reader` moves to 0.11.1 to close
a potential memory-safety issue when reading metadata ranges from
untrusted wheels. 0.12.7 adds the matching cache guard: source archives
whose hashes do not match are rejected before their extracted contents
are persisted, so a bad download can no longer poison the shared cache
for later resolves.

The span also carries work this repository benefits from directly.
0.12.8 speeds up dependency-graph construction from large lockfiles by
indexing packages during traversal, and extends that indexing to
exports, dependency trees, audits and freshness checks; both 0.12.8 and
0.12.9 stop concurrent uv processes from redundantly downloading or
extracting the same wheel, which is what a parallel CI matrix does.
0.12.9 adds `--no-locked` and `--no-frozen` so a single invocation can
opt out of `UV_LOCKED`/`UV_FROZEN`, and gives the explicit flags
precedence over those environment variables.

No lockfile revision or resolver-algorithm change lands in the span, so
this moves the pinned binary only and leaves uv.lock alone.

what:
- .tool-versions: uv 0.12.6 -> 0.12.9

See also:
- https://github.com/astral-sh/uv/releases/tag/0.12.7
- https://github.com/astral-sh/uv/releases/tag/0.12.8
- https://github.com/astral-sh/uv/releases/tag/0.12.9

Author: tony

.tool-versions

@@ -1,3 +1,3 @@
 just 1.58.0
-uv 0.12.6
+uv 0.12.9
 python 3.14 3.13 3.12 3.11 3.10