Refresh the lock and move CI to setup-uv v10.2.0 and uv 0.12.17 (#139)

## Summary

Part of the 2026-09-21 dependency sweep.

- `uv.lock`: `uv lock --upgrade` moves two transitive packages,
multidict 6.8.0 to 6.9.0 and watchfiles 1.2.0 to 1.3.0. No prerelease
versions are in the lock.
- CI: `astral-sh/setup-uv` moves from v10.1.0 to v10.2.0, and its uv
`version:` input from 0.12.16 to 0.12.17, in `ci.yml`, `publish.yml` and
`security.yml`. Dependabot cannot see that input.

The lock is dev-side only, and the published package's declared ranges
are unchanged, so there is no version bump or release.

Worked with: Varun. Not done: nothing else was outdated.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

Unchanged.

## Test plan

After `uv sync --all-extras --all-groups`, locally: ruff check, ruff
format --check, ty (package and examples), vulture and pytest (1869
passed, 4 skipped, 95.37% coverage) all exit 0. OSV over `uv.lock` finds
no issues.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally (no new
behavior; the existing suite passes)
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed (no
public surface change)
- [x] No secrets, credentials, or personal data in the diff or the tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: vvillait88

.github/workflows/ci.yml

@@ -22,9 +22,9 @@ jobs:
       - uses: useblacksmith/checkout@v1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.1.0
+        uses: astral-sh/setup-uv@v10.2.0
         with:
-          version: "0.12.16"
+          version: "0.12.17"
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/publish.yml

@@ -19,9 +19,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
-          version: "0.12.16"
+          version: "0.12.17"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

.github/workflows/security.yml

@@ -39,9 +39,9 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: useblacksmith/checkout@v1
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
-          version: "0.12.16"
+          version: "0.12.17"
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"