chore: commit uv.lock

uv's recommended practice since 0.5 is to commit the lockfile for both
applications and libraries — pins the dev environment so contributors
and CI resolve identical versions, and dep drift shows up as a
reviewable diff.

This repo has never committed it (not gitignored either — just plain
untracked from before uv-first workflow). Establishing it now as
source of truth. Downstream PyPI consumers continue to resolve via
`pyproject.toml` ranges, so this is purely a dev-side change.

Author: KylinMountain