chore: Replace remaining bare uv commands with $(UV_BIN) in Makefile

[MohanLaksh]

Problem

PR #3886 introduced $(UV_BIN) to resolve uv from PATH or ~/.local/bin/uv and converted 16 call sites. However, ~70 bare uv commands remained in the Makefile, all subject to the same "No such file or directory" failure when uv isn't on PATH inside an activated venv or in certain installation layouts.

Impact: Build failures across multiple make targets when uv is not directly accessible on PATH.

Closes #3946

Root Cause

When PR #3886 added the UV_BIN variable to fix uv resolution issues, it only converted the 16 most problematic call sites. The remaining ~70 bare uv commands (tool install, run, pip, build) were not systematically converted at that time.

Solution

Mechanical find-and-replace of all remaining bare uv commands with $(UV_BIN), following the established pattern from PR #3886.

Why this approach: Simple, consistent with existing pattern, no logic changes required, maintains backward compatibility with all existing developer setups.

Categories replaced:

• uv tool install → $(UV_BIN) tool install (highest priority - runs outside venv)
• uv run → $(UV_BIN) run
• uv pip → $(UV_BIN) pip
• uv build → $(UV_BIN) build

Implementation Details

• uv tool install: 2 instances (lines 4730, 4735)

  • sonar-deps-podman target
  • sonar-deps-docker target
  • Highest priority as these run outside any venv

• uv run: 31 instances

  • Test targets: test-mcp-cli, test-mcp-rbac, test-mcp-access-matrix, etc.
  • Demo scripts: demo-a2a-agent-auth targets
  • Formatter/linter targets: black, isort, pylint, ruff

• uv pip: 35 instances

  • Package installations: grpcio-tools, playwright, mutmut, handsdown, code2flow, etc.
  • Dev dependencies: pytest-xdist, radon, yamllint, tomlcheck, etc.
  • Special cases: devpi, local PyPI, fuzzing dependencies

• uv build: 3 instances (lines 4904, 4920, 4932)

  • dist target (full build)
  • wheel target (wheel only)
  • sdist target (source distribution only)

Total: 71 replacements

Testing

✅ Syntax validation: Verified make targets parse correctly

make -n sonar-deps-podman  # UV_BIN expanded correctly

✅ Pattern verification: Confirmed all bare uv commands replaced

# Only comments and target dependencies remain (no command invocations)
grep -n " uv " Makefile | grep -v "UV_BIN" | grep -v "^[0-9]*:#"

✅ Category breakdown verified:

• uv tool install: 2 ✅
• uv run: 31 ✅
• uv pip: 35 ✅
• uv build: 3 ✅
• Total: 71 ✅

✅ Git diff verified: 71 deletions, 71 additions (1:1 replacement)

Breaking Changes

None - this maintains backward compatibility with all existing developer setups.

Checklist

• All 71 bare uv commands replaced with $(UV_BIN)
• Makefile syntax validation passes
• No unintended changes to comments or help text
• Follows pattern established in PR fix(auth): eliminate duplicate DB sessions in auth and RBAC middleware #3886
• Closes [CHORE]: Replace remaining bare uv commands with $(UV_BIN) in Makefile #3946