version-bump: move the in-place uv.lock version edit into a tested script #429

What

The bump job of version-bump.yml sets the project's version line in uv.lock with an inline awk program and shell checks, about 40 lines in the workflow file. Move this into a small script under scripts/ with unit tests, and call it from the workflow.

Why

The edit decides whether a release can be made. If it fails, or changes more than that one line, the job that pushes refuses the result and no version is pushed. Inline workflow code is not covered by the repository's tests and is harder to review. A script can be tested on every platform that the test jobs cover.

Scope

• The script edits exactly one line: the version line of the project's own package entry, directly under its name line and followed by the source line of a local project. It fails with a clear message otherwise, for example: no entry, two entries, a registry source, a version that differs from the expected one, CRLF line ends, or a missing final newline.
• It runs in the read-only bump job. Since that job already runs package code, the script may be Python run through uv run, or it may stay shell.
• The job that pushes keeps its own independent check of the lock; the script does not replace it.
• Unit tests cover every case above, plus the normal case on a copy of the current lock.

Done when

• The real bump job produces the same one-line lock change as today.
• The tests run in CI.

Related: #418