feat: build Docker image from committed uv.lock

[anasstahr]

Summary

Changes

• Replaces pip install mcp-proxy-for-aws (unpinned, pulls latest from PyPI) with uv sync --frozen --no-dev --no-editable (installs exact versions from committed uv.lock)
• Removes python3.13-pip system package (no longer needed)
• Copies uv binary from pinned ghcr.io/astral-sh/uv:0.8 image
• Entrypoint uses the venv binary directly instead of system-wide install

User experience

No user-facing change. Container images now have the same pinned, audited dependencies as the PyPI package — what you test is what you ship.

Checklist

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

Is this a breaking change? (Y/N)

• Yes
• No

Please add details about how this change was tested.

• Docker build tested locally
• Did integration tests succeed?
• If the feature is a new use case, is it necessary to add a new integration test case?

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.