fix: install uvx in post-code and post-fix scripts

[ralphbean]

Summary

Completes the pre-commit tooling setup by adding uvx installation to scaffold post-scripts. Agent runs were failing when the ty pre-commit hook tried to run Python type checking because uvx wasn't available on GitHub Actions runners.

Note: This fix has already been manually applied to the .fullsend repo in fullsend-ai/.fullsend#29. This PR updates the scaffold templates so future enrolled repos get the complete tooling setup.

Root cause: PR #831 added lychee but didn't address uvx, which is also required by pre-commit hooks (specifically the ty hook that runs via uvx ty check).

Changes:

• ✅ Install uv/uvx v0.11.14 before running pre-commit hooks
• ✅ Add SHA256 verification following gitleaks/lychee pattern
• ✅ Extract both uv and uvx binaries to ~/.local/bin
• ✅ Update section numbering in both scripts
• ✅ Applied to both post-code.sh and post-fix.sh in scaffold templates

Impact: This prevents agent run failures where the ty pre-commit hook fails with:

Executable 'uvx' not found

Background: This builds on the tooling setup started in #831 (lychee) and #783 (markdown link linter). Together, these ensure all pre-commit hooks have their required tools available.

Test plan

• Verify SHA256 hash matches official uv 0.11.14 release
• Check installation logic follows gitleaks/lychee pattern
• Confirm both uv and uvx are extracted from tarball
• Same fix already deployed to .fullsend repo (fix: install lychee and uvx in post-scripts .fullsend#29)
• Test that new repo enrollments work with ty hook enabled

Related work

• Closes Remove --ignore unresolved-import --ignore unresolved-attribute from ty pre-commit hook #100 (by ensuring uvx is available for ty hook)
• Related to Security: pre-commit hooks in post-code/post-fix run outside sandbox with full credential access #830 (pre-commit security considerations)
• Builds on fix: install lychee in post-code and post-fix scripts #831 (lychee installation)
• Builds on chore: add markdown link linter and fix broken links #783 (markdown link linter addition)
• Deployed to .fullsend: fix: install lychee and uvx in post-scripts .fullsend#29

🤖 Generated with Claude Code

[github-actions]

fullsend review is working on this — view logs

[github-actions]

Site preview

Preview: https://63501432-site.fullsend-ai.workers.dev

Commit: 4f605635d94b5bf12b039f384f3ef13e3460418a

[fullsend-ai-review]

Review: #843

Head SHA: 4f60563
Timestamp: 2026-05-12T00:00:00Z
Outcome: comment-only

Summary

The change is well-structured and follows existing installation patterns (gitleaks, lychee) consistently. SHA256 verification, conditional installation guard, and PATH setup are all correct. Two non-blocking findings: the PR body will auto-close issue #100 on merge, but the issue requests removing --ignore flags from the ty hook — this PR only installs uvx as a prerequisite and does not fulfill that request. Additionally, section numbering in post-fix.sh has a collision after the insertion.

Findings

Medium

• [Intent alignment] PR body — PR declares "Closes Remove --ignore unresolved-import --ignore unresolved-attribute from ty pre-commit hook #100" but issue Remove --ignore unresolved-import --ignore unresolved-attribute from ty pre-commit hook #100 requests removing --ignore unresolved-import --ignore unresolved-attribute from the ty pre-commit hook. This PR installs uvx so the ty hook can execute, which is a prerequisite for Remove --ignore unresolved-import --ignore unresolved-attribute from ty pre-commit hook #100 but does not address the issue's actual request. The Closes keyword will auto-close the issue on merge, which would be premature.
  Remediation: Change "Closes Remove --ignore unresolved-import --ignore unresolved-attribute from ty pre-commit hook #100" to "Related to Remove --ignore unresolved-import --ignore unresolved-attribute from ty pre-commit hook #100" or "Prerequisite for Remove --ignore unresolved-import --ignore unresolved-attribute from ty pre-commit hook #100" in the PR body.

Low

• [Style/conventions] internal/scaffold/fullsend-repo/scripts/post-fix.sh — Inserting the new section 4 ("Install uv and uvx") bumps sections 4→5, 5→6, 6→7, but sections 7 ("Iteration-cap warning label") and 8 ("Summary") were not renumbered. After merge, both "Process structured output" and "Iteration-cap warning label" will be labeled section 7.
  Remediation: Renumber "Iteration-cap warning label" to 8 and "Summary" to 9 in post-fix.sh.

Footer

Outcome: comment-only
This review applies to SHA 4f605635d94b5bf12b039f384f3ef13e3460418a. Any push to the PR head clears this review and requires a new evaluation.

[ralphbean]

The code agent run that tested this PR (run 25753770793) failed because the lychee binary installation in the post-code script is broken — the tarball has the binary inside a lychee-x86_64-unknown-linux-gnu/ subdirectory, but the extraction assumes it's at the archive root.

Fix PR: fullsend-ai/.fullsend#31

Once that's merged, agent runs against this PR should pass the lint-md-links pre-commit hook.