Run CI test jobs from uv.lock instead of unlocked pip installs #3993

The Cloud Run image for the Public API installs with uv sync --frozen --no-dev --no-editable from uv.lock (gcp/cloud_run/Dockerfile), but the CI test jobs install with make install, which ran pip install -e ".[dev]". That command ignores uv.lock and resolves the newest releases on PyPI, so the tests run against versions production does not use.

This has already caused a CI-only failure. In PR #3933's CI run 39629243016, the Test job installed SQLAlchemy 2.1.6 and psycopg 3.3.6, but uv.lock pins SQLAlchemy 2.0.49 and psycopg 3.3.4. Six tests failed only in CI.

Other places install outside the lock too:

• The parallel live staging tests (pip install pytest pytest-xdist httpx) and the production candidate smoke tests (pip install pytest httpx) install unpinned packages.
• The versioning job installs towncrier unpinned.
• The Alembic v2 check and the cross-database integration tests run uv run without --frozen, which re-resolves when the lock is out of date.
• Every uv-based job runs on the Python 3.14 that .python-version selects, not the 3.12 the Cloud Run image runs.

Goal: every CI test job installs from uv.lock and runs its tests through uv run --frozen on Python 3.12, and make install and make test do the same locally. A test should fail if a test job installs outside the lock.