fix: keep release lock metadata consistent

[abrichr]

Summary

• repair the editable root lock version from 0.80.2 to the released 0.89.0
• regenerate the publishable no-sources lock from current pyproject metadata and enforce it with uv sync --locked --extra dev --no-sources
• make Semantic Release stamp only the editable root version, stage uv.lock, and build once inside the generated release commit
• install exact uv==0.11.29 inside the Semantic Release Docker action and fail closed with an &&-chained build command
• remove ineffective host setup steps from the Docker-action release job; pin uv 0.11.29 in Python 3.12 test CI
• make pre-1.0 behavior explicit with major_on_zero = false and allow_zero_version = true
• pin every third-party GitHub Action, including docs dispatch, to an immutable commit SHA and add regression gates

Lock delta

uv lock --no-sources changed uv.lock by 494 additions and 40 deletions. It added 14 previously missing optional flow/OCR package entries, updated registry openadapt-types from 0.1.0 to 0.3.0, and synchronized root extra metadata. No existing third-party package version was upgraded other than openadapt-types; the resolver retained existing pins where possible.

Action boundary

Pinned Semantic Release commit 7b3f716 declares runs.using: docker; its Dockerfile is based on python:3.13-bookworm and does not install uv. Runner setup-uv therefore could not supply the release build. The build command now installs uv inside that container before synchronizing and staging the lock.

Evidence

• exact uv 0.11.29 / Python 3.12 locked no-sources sync passes and installs the 68-package base/dev environment without rewriting the lock
• workflow-equivalent light suite: 1626 passed, 54 skipped, 17 deselected
• Ruff, YAML parsing, and lock verifier pass
• wheel/sdist build as 0.89.0; wheel metadata reports Version: 0.89.0
• disposable Semantic Release 9.15.2 simulation with pip present computed 0.89.1, used uv 0.11.29, built matching artifacts, and committed pyproject.toml=uv.lock=0.89.1
• a negative simulation without pip proved the && chain fails rather than continuing to an ambient host uv

Release impact

Merging this fix: change is expected to cut 0.89.1. Simulations used --no-push --no-vcs-release; this PR has not published or merged anything.

The lock and in-container build repairs are release/CI correctness for a launch-adjacent package. Action pinning is supply-chain hardening included in the same release-path change.