chore: Harden the ps1 delegators (WindowsApps python stub) and pin uv in the lint workflows #259

DISCLOSURE: LLM-GENERATED TEXT

Follow-ups from the session 090 adversarial review of #258. Neither blocks; both are one-line-scale hardening of the four ps1 delegator files.

1. The WindowsApps python stub trap

The delegators' fallback chain (uv -> python -> python3) resolves Get-Command python on a Windows machine without real python to the Microsoft Store's 0-byte WindowsApps stub, which exits 9009; the hook then fails with no hint that no runner exists. Any machine running pre-commit already has python, so the practical blast radius is small - but the failure mode should say what happened.

Fix sketch: verify the candidate actually runs (& --version) before selecting it, or detect the WindowsApps stub path and skip it. Applies to all four: lint-skill-sizes.ps1, lint-unity-meta.ps1, tests/test-lint-skill-sizes.ps1, tests/test-lint-unity-meta.ps1.

2. Pin uv in the lint workflows

Both llm-instructions-lint.yml and unity-meta-lint.yml install uv with an unpinned python -m pip install uv. A breaking uv release would fail these jobs arbitrarily. The repo's exact-pin convention suggests uv==<version>; note the pip cache is keyed on tooling~/pyproject.toml, so a pin change there is invisible to the cache key - decide whether the key should also cover the workflow file (as #256's pyright cache comment already suggests for its own inputs).

Related

• chore: Migrate all scripts (js, ps1, bash, batch, etc) to typed python via uv #220 (typed python migration; the delegator pattern), chore: Type-check the python tooling with a pinned pyright step #256 (the typing gate's cache note).