ci: download uv directly from GitHub Releases

[NouraldinFarge]

Why

DrawScope main CI run 32910519188 succeeded, but setup-uv resolved latest to uv 0.12.6, requested it from the Astral mirror, received HTTP 404, emitted a warning annotation, and then succeeded from the official GitHub release URL.

The pinned setup-uv v9 action documents download-from-astral-mirror as a supported boolean input with a true default. Its pinned source emits this exact warning before retrying GitHub Releases. Repository history provides no documented reason for CI and release to track latest while dependency auditing remained on uv 0.11.30.

This focused change makes setup deterministic across CI, dependency auditing, and release builds by pinning the already hosted-tested uv 0.12.6 and downloading it directly from the official GitHub release source.

Scope

• Keeps astral-sh/setup-uv pinned to c771a70e6277c0a99b617c7a806ffedaca235ff9.
• Pins uv 0.12.6 consistently in all three workflows.
• Keeps existing cache behavior unchanged.
• Does not weaken or skip any test, audit, or release validation.
• Covers all three setup-uv invocations in the repository.

Verification

• Branch is based on exact main commit 25d4be7.
• git diff --check passes.
• Three pinned setup-uv uses, three exact uv 0.12.6 inputs, and three explicit direct-download inputs were verified.
• Full hosted CI, CodeQL, and dependency-audit checks are required on exact head d053ad4 before merge.

Primary implementation references:

• https://github.com/astral-sh/setup-uv/blob/c771a70e6277c0a99b617c7a806ffedaca235ff9/action.yml
• https://github.com/astral-sh/setup-uv/blob/c771a70e6277c0a99b617c7a806ffedaca235ff9/src/download/download-version.ts