chore(security): add 7-day exclude-newer cooldown

Refuse to resolve any PyPI dependency uploaded in the last 7 days
(`[tool.uv] exclude-newer = "7 days"`) when this project is locked or
installed via uv. Mitigates blast radius of compromised dependencies
(typosquatting, account takeovers, dependency confusion).

pypiquant has no first-party PrimeIntellect packages in its closure
(cffi, torch, numpy), so no `[tool.uv.exclude-newer-package]`
exemptions are needed. The comment in pyproject.toml documents when to
add one.

Part 1 of 3 in a coordinated supply-chain hardening across PI repos.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: burnpiro

python/pyproject.toml

@@ -20,6 +20,14 @@ Issues = "https://github.com/PrimeIntellect-ai/pi-quant/issues"
 [project.optional-dependencies]
 dev = ["pytest","torch","numpy","pre-commit","ruff", "matplotlib", "twine"]
 
+[tool.uv]
+# Supply-chain cooldown: new PyPI uploads must age 7 days before resolution
+# picks them up. Applies whenever this project is locked or installed via uv.
+# pypiquant has no first-party PrimeIntellect dependencies in its closure, so
+# no exclude-newer-package exemptions are needed yet — add a
+# [tool.uv.exclude-newer-package] entry when that changes.
+exclude-newer = "7 days"
+
 [tool.ruff]
 line-length = 120
 target-version = "py38"