Evaluate uv adoption for Python dependency management

[nitrobass24]

Summary

Evaluate adopting uv as the Python dependency manager, replacing pip in Dockerfiles and CI.

Context

In #280 we consolidated Python dependencies to pyproject.toml (PEP 621) with requirements.txt and requirements-test.txt as generated files consumed by Docker and CI. pip is used for all installs.

uv would provide:

• Lockfile (uv.lock) for reproducible installs
• Faster installs in Docker builds and CI
• uv sync --group test to install dependency groups directly from pyproject.toml without maintaining separate requirements files
• uv export to generate requirements files if needed for compatibility

Trade-offs

• Adds a new tool dependency (needs to be installed in Dockerfiles and CI)
• pip works fine for our scale (3 runtime deps, 5 test deps)
• uv is moving fast but is now widely adopted

Acceptance criteria

• Evaluate whether uv simplifies the Docker build or adds unnecessary complexity
• If adopting: update Dockerfiles, CI, and Makefile to use uv
• If adopting: commit uv.lock for reproducible installs
• If deferring: document decision and close

[nitrobass24]

uv Evaluation & Implementation Summary

Recommendation: Adopt uv — implemented in #311.

What changed

• pyproject.toml + uv.lock are now the single source of truth for all Python dependencies
• requirements.txt and requirements-test.txt deleted (they were manual copies with "keep in sync" comments)
• Docker builds and CI jobs now use uv pip install --system instead of pip install

Benefits

• Reproducible builds: uv.lock pins exact versions and hashes — no more floating installs
• Faster CI: uv installs are 10-100x faster than pip (parallel downloads, Rust-based resolver)
• Single source of truth: No more dual-file maintenance burden
• Zero image size impact: uv binary is only used in builder stages and removed before the final Docker image

Architecture

• Production Dockerfile: COPY --from=ghcr.io/astral-sh/uv:latest /uv into builder stage, removed after install
• Test Dockerfile: Same pattern with --group test
• CI: astral-sh/setup-uv@v6 action + uv pip install --system

Lock file maintenance

To update dependencies: cd src/python && uv lock --upgrade
To add a dependency: edit pyproject.toml, then uv lock