PYTHON-5980 Commit uv.lock and automate weekly updates

[blink1073]

PYTHON-5980

Changes in this PR

Commits uv.lock and moves routine dependency upgrades to a scheduled workflow, reversing d150c687 (PYTHON-5862).

• uv.lock is tracked again, and CI fails when it drifts from pyproject.toml.
• Dependabot no longer opens uv version-update pull requests. Security updates continue.
• A weekly workflow keeps a single open pull request with the upgraded lock, using the action from PYTHON-5980 Add uv lock update action mongodb-labs/drivers-github-tools#113.
• .github/actions/set-uv-exclude-newer is removed. Its absolute cutoff conflicts with a committed lock, and pyproject.toml supplies the cooldown.
• CONTRIBUTING documents lockfile regeneration.

Requires an automation environment holding APP_ID and APP_PRIVATE_KEY. The workflow is pinned to bc33fb6, the merged v3 SHA from mongodb-labs/drivers-github-tools#113.

Test Plan

• The committed lock matches pyproject.toml, and deleting it and regenerating produces an identical file.
• The new uv lock --check step was tested in both directions: it passes on the committed lock, and it fails when pyproject.toml changes without a relock.
• just typing, just lint, and just lint-manual pass.
• The workflow was exercised end to end against a fork with a real GitHub App: dry run, create, update in place, and recreate after close.

Checklist

Checklist for Author

• Did you update the changelog (if necessary)?
• Is there test coverage?
• Is any followup work tracked in a JIRA ticket? If so, add link(s).

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

AI assistance disclosure

Claude Code was used throughout: design, implementation, tests, review, and the end to end validation runs. Every change has been reviewed line by line by the author.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/test-python.yml:54

• The lockfile drift check runs after linting/build/typecheck and the synchro smoke test, so a simple uv.lock mismatch will still consume most of the job time before failing. Consider moving uv lock --check immediately after installing uv (and before just install) to fail fast and reduce CI time/cost.

      - name: Check lockfile is up to date
        run: |
          uv lock --check

CONTRIBUTING.md:593

• This sentence says to "take either side" when resolving a conflict, but the example only shows git checkout --ours. Consider tightening the wording to match the example (or mention --theirs explicitly) to avoid confusion.

To resolve a `uv.lock` conflict when rebasing, take either side and regenerate rather
than editing the file by hand:

[Copilot]

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated no new comments.

[NoahStapp]

Test failure related?