ci: keep uv tool versions synchronized

[EmadHelmi]

Summary

Exclude the uv pre-commit mirror from isolated Dependabot updates, document the coupled upgrade policy, and test the configuration.

Motivation

The uv hook revision and GitHub Actions UV_VERSION must remain identical. A single-file Dependabot update cannot satisfy that invariant and produces an unmergeable pull request.

Testing

• Targeted publication tests passed.
• The complete pre-commit quality gate passed.
• The pre-push coverage gate passed before push.

Checklist

• I completed the pull-request checklist.
• I ran the relevant local quality gates.
• I added a regression test for the Dependabot exclusion.
• I updated the development-tooling documentation.
• I verified that the change contains no secrets or private data.
• I agree that my contribution may be distributed under the MIT License.