Pin the CI uv release and regenerate the lock with it

.github/workflows/pr_code_changes.yaml

@@ -44,6 +44,8 @@ jobs:
         - uses: actions/checkout@v6
         - name: Install uv
           uses: astral-sh/setup-uv@v8.1.0
+          with:
+              version: "0.12.14"
         - name: Set up Python
           uses: actions/setup-python@v6
           with:
@@ -68,6 +70,8 @@ jobs:
           allow-prereleases: true
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
+        with:
+          version: "0.12.14"
       - name: Install package (no country-model extras)
         run: uv pip install --system .
       - name: Smoke-import core modules
@@ -83,6 +87,8 @@ jobs:
       - uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
+        with:
+          version: "0.12.14"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -131,6 +137,8 @@ jobs:
           uses: actions/checkout@v6
         - name: Install uv
           uses: astral-sh/setup-uv@v8.1.0
+          with:
+              version: "0.12.14"
 
         - name: Set up Python
           uses: actions/setup-python@v6

.github/workflows/pr_docs_changes.yaml

@@ -20,6 +20,8 @@ jobs:
         uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
+        with:
+          version: "0.12.14"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:

.github/workflows/push.yaml

@@ -49,6 +49,8 @@ jobs:
         uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
+        with:
+          version: "0.12.14"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -116,6 +118,8 @@ jobs:
         run: git fetch --tags --force
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
+        with:
+          version: "0.12.14"
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
@@ -166,6 +170,8 @@ jobs:
         uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
+        with:
+          version: "0.12.14"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:

changelog.d/521.fixed.md

@@ -0,0 +1 @@
+Pinned the uv release in every CI `setup-uv` step and regenerated the lock with it, so the Versioning lock refresh reproduces the reviewed dependency graph instead of failing on resolver-version marker rewrites.

docs/release-bundles.md

@@ -51,7 +51,10 @@ from PyPI without local sources, and permits only the root package version to ch
 in the reviewed lock. Every locked distribution must use an HTTPS artifact URL
 on PyPI's `files.pythonhosted.org` host and a valid SHA256 digest; a registry source
 label alone is insufficient. Any dependency graph change fails and restores the original
-lock; stage such changes in a reviewed PR instead. The helper then runs the actual
+lock; stage such changes in a reviewed PR instead. Every workflow pins the uv release in its
+`setup-uv` step: the lock's dependency-marker spelling depends on the resolver
+version, so an unpinned latest uv can rewrite reviewed edges and fail this check.
+Raise that pin and regenerate `uv.lock` with the same uv in one reviewed PR. The helper then runs the actual
 `uv lock --check`. Final unpublished dependency pins must wait for registry
 publication before these checks can pass.