Sweep: uv 0.12.20 in workflows and coverage 7.16.2

[vvillait88]

Summary

Maintenance sweep. Moves the uv pin passed to astral-sh/setup-uv in the CI, publish and security workflows from 0.12.17 to 0.12.20 (dependabot cannot see workflow inputs), and takes the remaining available lock upgrade, coverage 7.16.1 to 7.16.2. Worked with Varun. Nothing else was outdated: uv lock --upgrade --dry-run now reports no changes.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

Ran locally after uv sync --all-extras --all-groups: ruff check, ruff format --check, ty check, vulture (as CI invokes it), and pytest (183 passed, 8 skipped, 99.85% coverage). osv-scanner over uv.lock: 24 packages, no issues. No prerelease versions in the lock.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests