chore(tooling): run Makefile Python scripts through uv

[kevinsslin]

Summary

Run every Makefile-owned Python tooling script through the uv-managed project environment. This keeps local targets working on systems that have uv and python3 but no bare python alias.

Root cause: four Makefile recipes bypassed the documented uv workflow and depended on a host-level executable name that is not portable across supported development environments.

Type of change

• chore: / ci: / build: — tooling, CI, packaging

Linked issue: Closes #1740

OpenSpec

• Not applicable — docs / CI / chore only

Change directory: N/A

Changes

• Run the proxy architecture checker through uv run python.
• Run integration shard verification and selection through uv run python.
• Run wheel asset verification through uv run python.
• Keep CI-runner, container-entrypoint, and Helm-runtime Python calls out of scope because those environments provision Python explicitly.

Test plan

The reproducing host has uv and python3, but command -v python returns no executable.

$ make architecture-check
proxy architecture checks passed

$ uv run python .github/scripts/pytest_shards.py --shard-count 3 --verify
OK: 92 integration-core test files partitioned across 3 shards

$ make lint
proxy architecture checks passed
All checks passed!
925 files already formatted

$ make package
Successfully built codex_lb-1.23.0.tar.gz and codex_lb-1.23.0-py3-none-any.whl
frontend assets verified in wheel: dist/codex_lb-1.23.0-py3-none-any.whl

No test source change is needed: the affected Make targets are the regression surface, and they were executed directly in the environment that previously failed before script startup.

Checklist

• Title is in Conventional Commits format (<type>(<scope>)?: <subject>).
• Linked the related issue / discussion above.
• Regression covered by executing every affected tooling path on a host without a python alias.
• Ran the relevant make <target> subset locally.
• OpenSpec is not applicable to this tooling-only change.
• Simplicity gates reviewed: no setting, README section, dashboard nav item, setup step, or default changed.
• CHANGELOG is not edited by hand.