Move CI to setup-uv v10.2.0 and uv 0.12.17

[vvillait88]

Summary

Part of the 2026-09-21 dependency sweep. The astral-sh/setup-uv action moves from v10.1.0 to v10.2.0, and the uv version: input it installs moves from 0.12.16 to 0.12.17 in ci.yml, publish.yml and security.yml. Dependabot cannot see that input, so it moves by hand. The lockfile is already current (uv lock --upgrade --dry-run reports no changes), and OSV over uv.lock finds no issues.

Worked with: Varun. Not done: no version bump or release, since nothing that ships in the package changed.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged.

Test plan

CI on this PR is the test: every job installs uv through the bumped action and input.

Checklist

• Tests cover the new behavior, and the suite passes locally (not applicable: workflow pins only; CI is the gate)
• Lint, format, and type checks pass (run by CI on this PR)
• Docs and README examples updated if the public surface changed (no public surface change)
• No secrets, credentials, or personal data in the diff or the tests