uv

494eed0b - Isolate reproduction publishing credentials from agent execution (#21106)

Isolate reproduction publishing credentials from agent execution (#21106) The regression-test agent currently shares its job with `id-token: write`, allowing untrusted code to mint repository-wide `uv-dev` credentials before the intended token exchange. Move publication into a separate trusted job that imports an immutable Git bundle, verifies its single parent and integration-test-only changes, and exchanges OIDC credentials only after the proposed commit has been validated. Co-authored-by: Zanie Blue <contact@zanie.dev>