fix: keep release lock metadata consistent

[abrichr]

Summary

• repair the committed editable lock version from 0.1.0 to the released 0.3.0
• make Semantic Release stamp only the editable root version, stage uv.lock, and build once inside the generated release commit
• install exact uv==0.11.29 inside the Semantic Release Docker action and fail closed with an &&-chained build command
• remove ineffective host setup steps from the Docker-action release job; pin Python 3.12 and uv 0.11.29 in test CI
• enforce uv sync --locked --extra dev so CI cannot silently repair drift
• make pre-1.0 behavior explicit with major_on_zero = false and allow_zero_version = true
• pin every third-party GitHub Action to an immutable commit SHA and add regression gates

Action boundary

Pinned Semantic Release commit 7b3f716 declares runs.using: docker; its Dockerfile is based on python:3.13-bookworm and does not install uv. Runner setup-uv therefore could not supply the release build. The build command now installs uv inside that container before synchronizing and staging the lock.

Evidence

• exact uv 0.11.29 / Python 3.12 locked sync passes
• full suite: 122 passed
• Ruff, YAML parsing, lock verifier, and offline locked resolution pass
• wheel/sdist build as 0.3.0; wheel metadata reports Version: 0.3.0
• disposable Semantic Release 9.15.2 simulation with pip present computed 0.3.1, installed uv 0.11.29, built matching artifacts, and committed pyproject.toml=uv.lock=0.3.1
• a negative simulation without pip proved the && chain fails rather than continuing to an ambient host uv

Release impact

Merging this fix: change is expected to cut 0.3.1. Simulations used --no-push --no-vcs-release; this PR has not published or merged anything.

The lock and in-container build repairs are release correctness for a launch-adjacent package. Action pinning is supply-chain hardening included in the same narrow release-path change.