chore(security): add 7-day exclude-newer cooldown

Refuse to resolve any PyPI dependency uploaded in the last 7 days
(`[tool.uv] exclude-newer = "7 days"`). Mitigates blast radius of
compromised dependencies (typosquatting, account takeovers, dependency
confusion).

Pins `required-version = ">=0.11.1"` so older uvs fail loudly instead
of silently parsing "7 days" as an RFC 3339 date and proceeding
*without* the cooldown — see uv#17908.

zeroband has no first-party PrimeIntellect packages in its dep closure,
so no `[tool.uv.exclude-newer-package]` exemptions are needed. Add the
table when that changes.

Lock regenerated: uv migrated the lockfile schema from revision 2 to
revision 3 (large mechanical churn — 0 packages removed, 0 versions
regressed). Schema migration is independent of the cooldown change.

Part 1 of 3 in a coordinated supply-chain hardening across PI repos.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: burnpiro

pyproject.toml

@@ -39,3 +39,13 @@ line-length = 120
 
 [tool.uv]
 dev-dependencies = ["ruff>=0.5.0", "pre-commit>=3.0.0","pytest>=7.0.0", "faker"]
+# Enforce a uv version that supports the friendly-duration form
+# (`"7 days"`) in the static pyproject parser. Older uvs silently parse
+# the value as an RFC 3339 date, emit a TOML parse warning, and proceed
+# *without* the cooldown — bypassing this security policy.
+required-version = ">=0.11.1"
+# Supply-chain cooldown: new PyPI uploads must age 7 days before resolution
+# picks them up. zeroband has no first-party PrimeIntellect dependencies in
+# its closure, so no exclude-newer-package exemptions are needed yet — add a
+# [tool.uv.exclude-newer-package] entry when that changes.
+exclude-newer = "7 days"