Make the Python validators runnable in an acq sandbox (uv, uv.lock) #491

Problem

In an acq sandbox on the published devenv image, agents can't run this repo's Python checks the documented way, so reviews and PRs ship with "not verified" lines (e.g. #488: "make validate and make scan-shell were blocked because the environment has no python executable", "python3 lacks jsonschema"):

• The image has python3 but no python, and the Makefile targets call bare python.
• make setup (pip install -e ".[dev]", which CONTRIBUTING recommends for sandbox contributors) fails: error: externally-managed-environment (PEP 668).
• PyYAML and jsonschema aren't installed.

What already works

The image ships uv (0.9.26), PyPI egress is allowed, and pyproject.toml pins the deps. In a sandbox at 800ba7e:

• uv run --no-dev make validate scan-shell: all validators pass, 0 scan errors.
• uv run --no-dev python integrations/isolation/acq-kits/validate-kits.py --strict: 10 kits + 2 templates valid.
• uv run --extra dev pytest -q scripts/tests: 448 passed.

uv run puts a venv python on PATH, which also fixes the bare-python targets. Each run writes an untracked uv.lock, because the repo doesn't commit one.

Proposal

1. In AGENTS.md (Validation row and commands) and CONTRIBUTING's sandbox workflow, document uv run --extra dev make validate / make ci as the sandbox path, in place of make setup.
2. Commit uv.lock (reproducible, and stops the untracked-file churn), or gitignore it if CI stays on pip.
3. Optionally, have make setup use uv sync --extra dev when uv is present.

Happy to send a PR for 1 and 2 if that direction works.