fix: Docker/CI build hygiene — silent lockfile fallback and setup-uv version mismatch

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install dependencies

Dockerfile

@@ -1,17 +1,25 @@
-FROM python:3.12-slim AS runtime
+FROM python:3.12-slim AS builder
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 WORKDIR /app
 
-# Install Python dependencies
-COPY pyproject.toml uv.lock* ./
-RUN uv sync --frozen --no-dev --no-editable 2>/dev/null || uv sync --no-dev --no-editable
+# Install Python dependencies (fails loudly on lockfile drift instead of silently re-resolving)
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-editable
 
 # Copy server source and config
 COPY server/ ./server/
 COPY config.yaml ./
 
+FROM python:3.12-slim AS runtime
+
+WORKDIR /app
+
+COPY --from=builder /app /app
+
+ENV PATH="/app/.venv/bin:$PATH"
+
 EXPOSE 8090
 
-CMD ["uv", "run", "python", "-m", "server.main"]
+CMD ["python", "-m", "server.main"]