Test uv and requirements takeovers keep the pin

Adds hermetic regression tests for #944. In both cases a hosted six
pin is switched to vendored mode and refused after the takeover's
upstream restore:

- a uv project whose pyproject.toml names [tool.uv] sources as an
  inline table
- a `uv pip compile --universal` requirements.txt that splits six
  across two exact pins by marker (#928's shape)

Either way, six must stay patched: vendored, or still hosted with
pyproject.toml, uv.lock and requirements.txt byte-for-byte as hosted
mode wrote them. Both tests fail on main, where the restore was
already made when the refusal came, and pass with the rollback.

Refs #944

Assisted-by: Claude Code:claude-opus-5-5

Author: claude