fix: AUT-1606 secure release workflow execution

[svcnemo-autobot]

Background

Release-library v1.8.10 directly interpolates release-ref into shell and pipes a mutable uv installer into sh.

What changed

Pass release-ref through env before validation. Replace both uv bootstrap pipes with the existing SHA-pinned astral-sh/setup-uv action.

Details

flowchart LR
  I[Release input] --> E[Environment variable]
  E --> V[Quoted SHA validation]
  A[Pinned setup-uv action] --> B[Build and test wheel jobs]

Loading

Tested

• actionlint on both changed workflows; ignored only pre-existing deployment and undeclared Slack findings
• git diff --check
• Verified no unversioned uv installer remains in executable workflows
• Tested valid SHA and command-substitution payload handling without execution