Single-source the CI uv pin and route lockfile recipes through it

[ciaranra]

Summary

• Add .github/uv.toml with required-version = "==0.11.14" as the single source of truth for the uv version. It lives inside .github/ deliberately: uv's config discovery never finds it there, so it does not enforce the pin on local uv commands (a root uv.toml would).
• Point all 14 astral-sh/setup-uv steps across 8 workflows at it via version-file: (the pinned setup-uv v7 documents uv.toml support for this input). Bumping uv is now a one-line change.
• Justfile: new uv-pin variable parsed from the same file; new just lock recipe that minimally re-resolves both lockfiles (root and exp/zluppy/) with the pinned uv, for version bumps and dependency edits; updatelocks now uses the pinned uv and regenerates exp/zluppy/uv.lock too, which it previously missed.
• RELEASING.md: the bump step now says just lock.

Context

During the 0.9.0.dev1 bump (#361), regenerating lockfiles with a local uv (0.11.16) newer than the CI pin (0.11.14) silently re-simplified unrelated dependency markers, polluting the diff. Nothing made the pin discoverable or the lock path deterministic. A dev regenerating locks with a floating uv could also fail CI's uv lock --check with a lock that looks up to date locally.

Assumption: including exp/zluppy/uv.lock in updatelocks is intended -- it was the only lockfile the refresh recipe skipped.

Stacked on #361 because both touch the same RELEASING.md lines; GitHub will retarget this PR to dev when #361 merges.

Validation

• just --evaluate uv-pin prints 0.11.14
• just lock runs both re-resolutions via uvx uv@0.11.14 and produces no diff on a clean tree
• uv lock --check with local uv 0.11.16 still passes from the repo root (pin file not discovered locally)
• All 14 setup-uv usages now use version-file:; git grep 0.11.14 .github/workflows/ is empty
• just lint passes over the whole repo

Post-release update

• RELEASING.md's "last exercised" note now records 0.9.0.dev1 (the full sequence -- tag, tag-run bundle, dry-run, manual publish, PyPI verify, GitHub pre-release -- was exercised on 2026-07-15).
• Rebased onto dev after Fix click and setuptools advisories in exp lockfiles #363 (exp lockfile advisory fixes) merged.