build: refresh and consolidate repository uv pins

Follow-up to #978. Repository-managed uv consumers use several pin forms, and the weekly binary-freshness workflow does not discover all of them. Consolidate the complete inventory on 0.12.8 and make future drift detectable without maintaining a per-file list in the workflow.

Required implementation

• Pin all 12 production consumers to 0.12.8:
  • data-management/viewer/backend/Dockerfile
  • evaluation/sil/scripts/osmo-lerobot-eval-entry.sh
  • infrastructure/setup/optional/isaac-sim-vm/scripts/install-dev-deps.sh
  • setup-dev.ps1
  • setup-dev.sh
  • shared/ci/smoke-import.sh
  • training/il/scripts/lerobot-train-osmo-entry.sh
  • training/il/scripts/lerobot/azureml-train-entry.sh
  • training/il/scripts/lerobot/lerobot-azureml.sh
  • training/rl/scripts/setup_isaac_runtime.sh
  • workflows/azureml/components/register.yaml
  • workflows/azureml/osmo-proxy-job.yaml
• Use these verified 0.12.8 integrity values at direct-download and image sites:
  • Linux x86_64: 2e2b37e9811e17675a9e70bed5e1a58fc8c0388be63d751d72cc735188c149ff
  • Linux aarch64: ba8661f4fd207c8e94814191598e619b355ac10d5014e851e21eb800f9ef2b00
  • PowerShell installer: c1c357b2945c4eb31f3380a6c0cb1c371f18b3c0d1856073f82d17cc52c892cb
  • OCI index: sha256:d1cbaeadc234fe19c0d93daabcf5e98738cd93c6d1dd4918ef6aa30735feb23a
• Extend scripts/security/Modules/PinnedToolVersions.psm1 so tracked candidate discovery includes .sh, .ps1, .yml, .yaml, .json, .jsonc, and Dockerfile* files.
• Preserve shell and PowerShell assignment discovery and add:
  • exact pip install ... uv==<version> discovery in shell, YAML, JSON, and JSONC command content;
  • versioned and SHA-pinned ghcr.io/astral-sh/uv discovery in Dockerfiles;
  • fail-closed errors when a configured package or image is present but malformed, dynamically versioned, unpinned, or not digest-pinned.
• Configure .github/workflows/check-binary-freshness.yml with the uv shell variable, PowerShell variable, Python package, and container image identities. Do not retain obsolete per-file references such as training/rl/scripts/train.sh.
• In data-management/viewer/backend/Dockerfile, declare the digest-pinned uv image as a named FROM stage and copy /uv and /uvx from that stage. Dependabot observes Docker FROM dependencies but not an external image referenced only by COPY --from=.
• Expand scripts/tests/security/PinnedToolVersions.Tests.ps1 to cover all supported formats, malformed and unpinned consumers, exclusions, parser failure behavior, and an integration assertion for the exact 12-file inventory above with one version.
• Update scripts/tests/setup-dev.Tests.ps1 expectations to 0.12.8.
• Update the pin-discovery documentation in:
  • scripts/README.md
  • docs/contributing/component-updates.md
  • docs/security/README.md

Acceptance criteria

• All 12 repository-managed uv consumers resolve to exactly 0.12.8; no production consumer is omitted.
• Direct downloads and the Docker image use the matching integrity values listed above.
• Freshness discovery finds assignment pins, exact Python-package pins, and digest-pinned container images automatically across the supported tracked formats.
• A malformed, dynamic, unpinned, or non-digest-pinned configured consumer fails discovery rather than silently disappearing from the inventory.
• The backend Dockerfile exposes uv as a FROM dependency for Dependabot.
• The repository inventory test asserts the exact 12 paths and one unique version.
• Targeted Pester tests, the full Pester suite, ShellCheck, PowerShell analysis, YAML/actionlint, Markdown lint, spelling, Docker build checks, inline-pip compliance, and OCI digest resolution pass.
• Runtime smoke coverage confirms uv 0.12.8 supports the repository's used python install, venv, sync, export, and pip install commands.
• Affected Azure ML IL lifecycle and pipeline E2E tests pass. OSMO tests may require a correctly aligned deployment storage configuration and workload-identity permission to read the target Azure ML workspace; report infrastructure blockers separately from uv failures.

Scope notes

• The issue deliberately targets 0.12.8. Dependabot applies a seven-day quarantine, so a newer release appearing during implementation does not change this issue's acceptance target.
• Preserve existing download-and-verification behavior.
• Automated freshness issue security: binary dependency updates available (3 stale) #1119 tracks release drift; this issue establishes the complete inventory and scanner coverage needed to make that automation reliable.