ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1

why: v10.0.0 is a deliberate breaking release one step after v9.0.0; upstream's own
note is "Another breaking release, directly after v9.0.0 but we think the added
security justifies that." It adds a `version: "latest-known"` selector that
installs the newest uv release with a known checksum, and reads a Python version
from a referenced `.tool-versions` file. v10.0.1 is a bug-fix patch only,
tolerating a transient manifest timeout.

The pin is the exact tag rather than a floating major on purpose: this action
stopped publishing major tags after v7, so `astral-sh/setup-uv@v10` does not
resolve. No inputs were added, removed or renamed across the span.

v10 also changes the cache default: under `enable-cache: auto` it now disables
caching for pull_request_target, workflow_run, release and tag-push triggers to
close a cache-poisoning path (astral-sh/setup-uv#984). This repository does run
setup-uv on release, but every one of its setup-uv steps sets
`enable-cache: true` explicitly, which overrides the default - so caching
behaviour here is unchanged.

Releases:
- https://github.com/astral-sh/setup-uv/releases/tag/v10.0.0
- https://github.com/astral-sh/setup-uv/releases/tag/v10.0.1

Author: tony

.github/workflows/docs.yml

@@ -40,7 +40,7 @@ jobs:
 
       - name: Install uv
         if: env.PUBLISH == 'true'
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
 

.github/workflows/tests.yml

@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
 
@@ -102,7 +102,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true