Keep uv.lock in sync on release so release PRs pass CI

[qinhaihong-red]

Parent

#33 (release pipeline)

What to build

release-please bumps the project version in pyproject.toml and src/caw/init.py, but it does not touch uv.lock, which pins the project's own package (caw) version. The result: every Release PR has pyproject at the new version and uv.lock at the old one, so the CI uv sync --locked step fails with "The lockfile at uv.lock needs to be updated, but --locked was provided." This already happened on Release PR #45 (v0.2.0), and because the merge landed on main, main's CI is currently red and any contributor running uv sync --locked fails.

Make the release flow keep uv.lock in lockstep with the version bump. Chosen mechanism: after release-please opens/updates the Release PR, the workflow runs uv lock and commits the refreshed lockfile onto the release branch, so the Release PR's own CI is green before merge.

Also includes the immediate remediation: a uv lock commit on main bringing the locked caw version to 0.2.0 so main's CI goes green now (a release PR fix alone does not repair the already-merged main).

Acceptance criteria

• main's CI is green again (uv sync --locked succeeds on main HEAD)
• A Release PR generated after this change carries a uv.lock whose caw version matches the bumped pyproject version, and its CI gates pass
• The lockfile refresh is automatic in the release workflow (no manual step per release)
• No double-run or recursion regression in the release pipeline (the anti-double-run design from CI and release pipeline: quality gates, release-please, and tag-triggered publishing #33 still holds)

Blocked by

None - can start immediately