ci: pin actions to commit SHA and install uv via script

Apple org Actions policy requires SHA-pinned actions and restricts
third-party actions. Pin actions/checkout to the apple-vetted v6 SHA and
install uv via its official script instead of astral-sh/setup-uv.

Author: DawerG

.github/workflows/ci.yml

@@ -16,8 +16,11 @@ jobs:
     runs-on: [self-hosted, macos, tahoe, ARM64]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Ensure uv
+        run: |
+          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - run: uv run --extra dev ruff check .
       - run: uv run --extra dev ruff format --check .
 
@@ -26,6 +29,9 @@ jobs:
     runs-on: [self-hosted, macos, tahoe, ARM64]
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Ensure uv
+        run: |
+          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - run: uv run --extra test pytest tests/ -n auto -m "not slow"