Refresh the lock and move CI to setup-uv v10.2.0 and uv 0.12.17

[vvillait88]

Summary

Part of the 2026-09-21 dependency sweep.

• uv.lock: uv lock --upgrade moves two transitive packages, multidict 6.8.0 to 6.9.0 and watchfiles 1.2.0 to 1.3.0. No prerelease versions are in the lock.
• CI: astral-sh/setup-uv moves from v10.1.0 to v10.2.0, and its uv version: input from 0.12.16 to 0.12.17, in ci.yml, publish.yml and security.yml. Dependabot cannot see that input.

The lock is dev-side only, and the published package's declared ranges are unchanged, so there is no version bump or release.

Worked with: Varun. Not done: nothing else was outdated.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged.

Test plan

After uv sync --all-extras --all-groups, locally: ruff check, ruff format --check, ty (package and examples), vulture and pytest (1869 passed, 4 skipped, 95.37% coverage) all exit 0. OSV over uv.lock finds no issues.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior; the existing suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (no public surface change)
• No secrets, credentials, or personal data in the diff or the tests