fix(coverage): materialize trusted uv lock dependencies

[seonghobae]

What

Extend the central base-commit Python dependency materializer so repositories that rely on uv.lock can produce an offline, fully hash-pinned dependency closure even when the GitHub runner does not already expose a trusted uv executable.

This draft initially carries bounded staging chunks and a self-removing verification workflow. The workflow reconstructs the reviewed source and regression suite, verifies exact SHA-256 receipts, runs focused tests, 100% statement/branch coverage and docstring checks, then commits only the canonical materializer and its tests. The draft must not become ready or merge until that cleanup commit exists.

Why

BandScope Python PRs currently pass their repository CI but fail the central OpenCode coverage sandbox because the validated base tree contains uv.lock dependency contracts and the coverage runner silently omits them when uv is absent. That turns missing environment materialization into misleading source-review failures.

Trust boundary

• Read uv.lock and sibling pyproject.toml only from the exact validated base SHA.
• Bootstrap one fixed official Astral uv archive through HTTPS.
• Verify the archive SHA-256, exact tar member, regular-file type, bounded archive/binary size, executable mode, and exact version.
• Run uv export --frozen --offline --no-emit-project --no-editable in an isolated temporary project.
• Reject nonempty exports that are not fully hash-pinned.
• Fail closed on trusted-tool download, extraction, version, execution, or export failures.
• Never expose PR-mutable dependency metadata to the networked image-build stage.

Verification completed locally

• Focused materializer tests: 36 passed.
• Materializer: 193 statements and 58 branches, 100% coverage.
• Relevant central contracts: 76 passed.
• Production docstrings: 100%.
• Python compile and git diff --check: passed.
• Exact BandScope base-tree integration: services/analysis-engine/uv.lock exported to a hash-pinned requirements closure; the dependency-free root project correctly emitted no installable closure.

Stack

This PR is intentionally stacked on #703 (fix/npm-workspace-coverage-root). It must be rebased or retargeted after #703 merges, and all exact-head security/review checks remain authoritative.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 421ed87d-a3d8-4c17-9da6-cea3cf55fd3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

The bounded bootstrap completed successfully and produced the verified canonical source/test pair at head bcd06d6b24777edcf56013975ea30fce37815d41. Because this branch is stacked on the closed #703 ancestry, the final two-file change has been reconstructed directly from main as clean replacement PR #743. Closing this stacked transport PR prevents unrelated ancestry from entering the default branch.