dx: add pyproject.toml and uv.lock (HOL lockfile finding, Maintenance 55/100) #512

Problem

Two HOL trust components are held down by files the repo doesn't have:

• Security (40%): one low finding, supply-chain.lockfile-missing: "Repository snapshot does not include a lockfile." Costs 5 points.
• Maintenance (5%): 55/100. HOL awards points for files in the source: 30 README, 25 SECURITY.md, 25 a package manifest, 20 a lockfile, 10 a license (capped at 100). There is no package manifest and no lockfile, which is 45 points left on the table.

README, SECURITY.md and LICENSE all exist, which would add up to 65, not 55. So one of them is not being credited. The likeliest is LICENSE: its first line is the CC BY-NC-ND title, and the repo is dual-licensed, which may not match a recognized license file. Worth confirming with the scanner once it runs in CI.

Proposed change

The repo already pins its Python tooling in requirements-dev.txt (PyYAML, numpy, Pillow, plus scripts/site/requirements.txt). Move that to:

• pyproject.toml: a non-published project ([project] with name, version and requires-python; dev dependencies in a dependency group). This is the package manifest.
• uv.lock: generated by uv lock and committed. This is the lockfile.

Keep requirements-dev.txt (or export it from the lock) if validate.yml / pages.yml install from it, so CI doesn't change shape in the same PR. Dependabot supports uv, so the weekly bumps (e.g. #508) keep working. Update the package-ecosystem entry in .github/dependabot.yml.

Before committing to a filename, check which lockfiles HOL's scanner recognises (hashgraph-online/hol-guard, rule dependency-lockfile-missing).

Acceptance

• pyproject.toml + uv.lock committed; python tests/run_all.py still passes from a fresh uv sync
• CI installs from the lock (or from a requirements file exported from it)
• Dependabot opens PRs against the new manifest
• After HOL rescans: no lockfile-missing finding, and Maintenance at or near 100

Expected effect

Security +5 (about +2 weighted) and Maintenance 55 -> 100 (about +2.3 weighted). Small, but it's the last step to a clean Security score once #511 lands.