chore(deps): pin uv to 0.11.26 and enable 72-hour dependency cooldown

[toshke]

What

• Pins uv from 'latest' to '0.11.26' in .mise.toml
• Adds [tool.uv] exclude-newer = "3 days" to pyproject.toml

Why pin uv?

uv = 'latest' means every mise install can silently pull a different uv binary, making builds non-reproducible. Pinning to an exact version gives reproducible installs across CI and local environments. Run mise install after merging to pull the pinned binary.

Why exclude-newer = "3 days"?

uv's exclude-newer resolver setting refuses to consider any package version published to PyPI within the last N days. Setting it to 3 days (72 hours) means:

• A newly published package — whether a legitimate release or a malicious typosquat — cannot enter this project's lockfile until it has been public for at least 72 hours
• That window gives the Python security community time to spot and report supply-chain attacks (hijacked maintainer accounts, malicious typosquats) before they reach your dependencies
• It has no effect on packages already in the lockfile; only new resolutions (adding or upgrading a dep) are gated

This is a resolver-level control: it applies whenever uv lock or uv add runs, with no runtime overhead.

Opting a specific package out

If you ever need to pull a package released less than 72 hours ago, temporarily comment out or remove the setting for that resolution, then restore it.

Checklist

• .mise.toml — uv = 'latest' → uv = "0.11.26"
• pyproject.toml — [tool.uv] exclude-newer = "3 days" added
• Run mise install locally after merging