PYTHON-5980 Commit uv.lock and automate weekly updates

[blink1073]

PYTHON-5980

Changes in this PR

Commits uv.lock and moves routine dependency upgrades to a scheduled workflow, reversing d150c687 (PYTHON-5862).

• uv.lock is tracked again, and CI fails when it drifts from pyproject.toml.
• Dependabot no longer opens uv version-update pull requests. Security updates continue.
• A weekly workflow keeps a single open pull request with the upgraded lock, using the action from PYTHON-5980 Add uv lock update action mongodb-labs/drivers-github-tools#113.
• .github/actions/set-uv-exclude-newer is removed. Its absolute cutoff conflicts with a committed lock, and pyproject.toml supplies the cooldown.
• CONTRIBUTING documents lockfile regeneration.

Requires an automation environment holding APP_ID and APP_PRIVATE_KEY. The workflow is pinned to a fork branch for testing and needs repinning to a merged SHA from mongodb-labs/drivers-github-tools#113.

Test Plan

• The committed lock matches pyproject.toml, and deleting it and regenerating produces an identical file.
• The new uv lock --check step was tested in both directions: it passes on the committed lock, and it fails when pyproject.toml changes without a relock.
• just typing, just lint, and just lint-manual pass.
• The workflow was exercised end to end against a fork with a real GitHub App: dry run, create, update in place, and recreate after close.

Checklist

Checklist for Author

• Did you update the changelog (if necessary)?
• Is there test coverage?
• Is any followup work tracked in a JIRA ticket? If so, add link(s).

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

AI assistance disclosure

Claude Code was used throughout: design, implementation, tests, review, and the end to end validation runs. Every change has been reviewed line by line by the author.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR restores uv.lock as a committed artifact and shifts routine Python dependency upgrades from Dependabot PRs to a scheduled GitHub Actions workflow, while adding CI enforcement to ensure the lockfile stays in sync with pyproject.toml.

Changes:

• Track uv.lock again (and stop ignoring it), and update pre-commit to avoid rejecting it as a large file.
• Add CI enforcement via uv lock --check, and document how to regenerate/resolve conflicts.
• Limit Dependabot’s uv ecosystem updates to security-only, and introduce a weekly workflow to maintain a single lockfile-update PR; remove the legacy set-uv-exclude-newer action.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
CONTRIBUTING.md	Documents the new dependency/lockfile update workflow and how to regenerate/resolve uv.lock.
.pre-commit-config.yaml	Excludes uv.lock from the “added large files” check so it can be committed.
.gitignore	Stops ignoring uv.lock so it can be tracked.
.github/workflows/uv-lock-update.yml	Adds weekly automation to upgrade and PR uv.lock updates.
.github/workflows/test-python.yml	Adds a CI step to fail if uv.lock drifts from pyproject.toml.
.github/dependabot.yml	Disables routine uv version-update PRs while keeping security updates.
.github/actions/set-uv-exclude-newer/action.yml	Removes the obsolete action that set an absolute UV_EXCLUDE_NEWER cutoff.