ci: install dependencies from uv.lock

[hectorvent]

Problem

CI installs with pip install -e ".[dev]", which ignores uv.lock and resolves the newest release of every dev tool on each run. As a result:

• ruff 0.16.10 started formatting Python code blocks inside README.md and failed ruff format --check on chore: add pytest-timeout and refresh uv.lock #6, with no change in this repo.
• CI and the lockfile had drifted apart: ruff 0.16.10 / testcontainers 4.15.0 in CI vs 0.15.12 / 4.14.2 in the lock.

Change

• Replace actions/setup-python with astral-sh/setup-uv (pinned to the v10.2.0 SHA, with caching on).
• Install with uv sync --locked --extra dev. If uv.lock is out of date with pyproject.toml, CI now fails.
• Run ruff, mypy and pytest through uv run.
• Set [tool.mypy] python_version to "3.10". The locked mypy 2.x rejects "3.9" and falls back to 3.10 with a warning. Ruff's py39 target and the 3.9 unit-test job still cover 3.9 compatibility.

Depends on #6

This branch includes #6's commit (pytest-timeout plus the refreshed uv.lock). Both are needed:

• main's lock pins testcontainers 4.14.2, which ships no type hints, so mypy --strict fails with Class cannot subclass "DockerContainer".
• The integration job passes --timeout=120, which needs pytest-timeout.

Merge #6 first, then rebase this branch so it reduces to the single CI commit.

Verified locally (against the locked versions)

• uv lock --check passes.
• Python 3.12: ruff check, ruff format --check, mypy floci and unit tests all pass.
• Python 3.9: unit tests pass.
• pytest -m integration --timeout=120 --co collects the integration tests.

[greptile-apps]

Confidence Score: 5/5

[High risk] Switches build and CI to use uv package manager.

The reviewed changes appear safe to merge.

Summary

CI now installs dependencies from uv.lock and runs checks through uv run. The latest change sets mypy's target to Python 3.10 without changing the package's Python 3.9 support.

• Adds pytest-timeout and refreshes the lockfile, including testcontainers.
• No actionable new issues found in the changes since the last review.
• No previous review threads were supplied; GitHub authentication prevented retrieving them.
• Adding greptile_confidence was attempted but blocked by missing GitHub authentication.

_{Reviews (2) · Last reviewed commit: "chore: set the mypy target to Python 3.1..." · Reviewed by Greptile}