fix: lock the semantic release runtime

[abrichr]

What failed

The pinned PSR Docker action still installed its dependencies at run time. GitPython 3.1.60 removed Actor.name_email_regex, so PSR 10.6.1 failed while it loaded the project configuration. The failed runs stopped before a version, tag, archive, GitHub Release, or PyPI upload existed. Upstream issue #1476 confirms the cause.

What changed

• The workflow now runs a repository-owned wrapper from the uv.lock environment.
• PSR stays at 10.6.1. GitPython stays at 3.1.59 until upstream PR #1477 ships in a reviewed PSR release.
• Hatchling 1.31.0 and uv 0.12.5 are locked too. The PSR build uses --no-build-isolation, so it doesn't start a second dependency resolver.
• The wrapper delegates to PSR unchanged. PSR still writes released, version, and tag to GITHUB_OUTPUT.
• Existing workspace checks, archive checks, PyPI publication, and GitHub Release publication stay in place.

Verification

• 238 passed, 2 skipped
• Ruff and actionlint
• Locked sync and lock validation
• Two locked builds produced identical wheel and sdist bytes
• Source-boundary and release-consistency guards on the built archives
• A configuration-load probe with PSR 10.6.1, GitPython 3.1.59, and Hatchling 1.31.0

Exact archive SHA-256 values:

• wheel: 46d6a762e14865ac2eda89757615fcee3ccaa29ea57f2b4e6e6c32fd558a5a97
• sdist: 9d3513c05917ce6a3e6c6f5f3d0ced2a691b77bdef4f7f26ee9d7470e0f98da0

No release workflow was rerun. Nothing was tagged or published.