feat(release): require versioned locked publication

Dockerfile

@@ -13,12 +13,15 @@ RUN test "${#SOURCE_COMMIT}" -eq 40 \
        esac \
     || { echo "SOURCE_COMMIT must be a 40-character lowercase commit" >&2; exit 1; }
 
-COPY pyproject.toml ./
+COPY pyproject.toml uv.lock ./
 COPY trex_core/ ./trex_core/
 
-RUN python -m pip install --no-cache-dir . \
+RUN python -m pip install --no-cache-dir "uv==0.11.14" \
+    && uv sync --locked --no-dev --no-editable \
     && useradd --create-home --uid 10001 trex
 
+ENV PATH="/opt/trex-core/.venv/bin:${PATH}"
+
 USER 10001:10001
 
 ENTRYPOINT ["trex-core-daemon"]