Migrate from pip to uv with lockfile

[janhoy]

Replace `pip` with `uv` across the project and commit a `uv.lock` lockfile.
uv gives us reproducible builds with exact transitive dependency pinning (we currently have no lockfile), 10–100x faster installs in CI and local dev, and a unified toolchain covering virtualenvs, builds, and tool execution.
Affects: Makefile, run.sh, Dockerfile, CI workflows, and install docs.