CI: install uv.lock with --locked --no-build (blocked on PyYAML 3.15 wheels) #684

Follow-up to #677, superseding #681 (closed).

#681 made CI install uv.lock as committed (uv sync --locked, UV_LOCKED=1, exclude-newer in [tool.uv]). Touching the uv sync lines made SonarCloud flag them with S8541 ("omitting --no-build can lead to the execution of setup scripts") and fail the quality gate (Security Rating C). The same lines on main run without --no-build too; the finding only surfaced because they were edited.

Goal

Install CI dependencies from the lock with --locked and --no-build, so no sdist setup code runs on the runners, in both python-package.yml and release.yml.

Blocker: PyYAML has no Python 3.15 wheel

uv sync --locked --all-extras --dev --no-build passes on 3.10 through 3.14 and fails on 3.15, which is both in the test matrix and the Python of the release job:

error: Distribution `pyyaml==6.0.3 @ registry+https://pypi.org/simple` can't be installed because it is marked as `--no-build` but has no binary distribution

PyYAML is required by the io and yaml extras and by the dev group (directly and through myst-parser, pre-commit, sphinxcontrib-mermaid). uv has no per-package allow-list to exempt it from --no-build. Upstream: yaml/pyyaml#951.

Unblocked when

A PyYAML release ships cp315 wheels and uv.lock is upgraded to it. Then reapply #681 with --no-build added to both uv sync calls.

Acceptance

• CI fails on a PR whose uv.lock does not match pyproject.toml, and passes otherwise (from CI re-resolves uv.lock instead of installing it as committed #677).
• uv sync in both workflows runs with --no-build, and SonarCloud no longer reports S8541 on them.