fix(ci): use locked tooling for image verification

.github/workflows/publish-image.yml

@@ -29,13 +29,15 @@ jobs:
           cache: pip
 
       - name: Install repository checks
-        run: python -m pip install ".[dev]"
+        run: |
+          python -m pip install "uv==0.11.14"
+          uv sync --extra dev --locked
 
       - name: Run repository lint
-        run: ruff check .
+        run: uv run ruff check .
 
       - name: Run repository tests
-        run: pytest
+        run: uv run pytest
 
       - name: Create excluded synthetic canary
         run: |

tests/release/test_image_contracts.py

@@ -73,6 +73,19 @@ exit "${scan_status}"'''
     )
 
 
+def test_repository_checks_use_the_locked_uv_environment():
+    steps = _workflow()["jobs"]["verify"]["steps"]
+    install = steps[_step_index(steps, "Install repository checks")]["run"]
+    lint = steps[_step_index(steps, "Run repository lint")]["run"]
+    tests = steps[_step_index(steps, "Run repository tests")]["run"]
+
+    assert 'python -m pip install "uv==0.11.14"' in install
+    assert "uv sync --extra dev --locked" in install
+    assert lint == "uv run ruff check ."
+    assert tests == "uv run pytest"
+    assert 'pip install ".[dev]"' not in install
+
+
 def test_tested_image_id_is_recorded_after_smoke_and_transferred_to_publish():
     workflow = _workflow()
     verify_steps = workflow["jobs"]["verify"]["steps"]