TST/DEP: migrate CI installer from pip to uv, setup lockfile, dependency caching, and make pyproject.toml the one source of truth for test dependencies

[neutrinoceros]

PR Summary

This is the first step towards #5310. I'm not adding a lock file yet, but I'm migrating existing CI to use uv instead of pip. From there, adding the lockfile will be a formality.
update 2025-11-23: I expanded the scope of the PR, now I don't expect follow ups to be needed.
Close #5310

The one piece that's missing from the PR is automated updates for the lock file. Since Dependabot doesn't support uv.lock at the moment, I can't do this bit in PR, but I am experimenting with Mend.io's Renovate and plan to use it in the future here.
update 2025/12/01: I was wrong. Dependabot already has support for uv.lock. I included the relevant piece of configuration.

PR Checklist

• New features are documented, with docstrings and narrative docs
• Adds a test for any bugs fixed. Adds tests for new features.

[neutrinoceros]

bleeding-edge failures are unrelated, see yt-project/unyt#599

[neutrinoceros]

I'm struggling to adapt the sdist test.
@yut23 do you have any clue what I'm doing wrong ?

[chrishavlin]

is there a particular reason to not enable the cache?

[neutrinoceros]

I actually want to enable it in a dedicated PR, but that requires a bit of fiddling to do it right, so it's simpler to just preserve the existing no-cache strategy for now.
It also works best in the presence of a lock file, which is why I'm not bothering with it right now

[neutrinoceros]

update: I added a lock file + caching everywhere except in a couple strategic places

• bleeding-edge CI: cache would rot too quickly to be worth anything
• wheels: using a cache for publishing creates a risk of a supply-chain attack via cache poisoning

[neutrinoceros]

to add to this comment: the idea is we could host a fork of nose within our org, apply this patch, and use the fork as the source instead of PyPI. This would only work with uv but would arguably less of a hack. Or we could also try to use nose2 ...

[neutrinoceros]

pre-commit.ci run

[neutrinoceros]

pre-commit.ci run

[chrishavlin]

just did a quick read through to keep up with changes on this PR -- hoping to have some time to do a more thorough read next week. but left one minor comment :)

[chrishavlin]

I'd replace geophysics with something more general and mapping-related since cartopy is used purely for 2d plotting and the term "geophysics" has broader meaning. Maybe just mapping ?

[neutrinoceros]

sure. Done.