ci: fix distribution metadata check and pin uv in docs build

Two unrelated CI breakages, both from unpinned tooling:

1. The Distribution build job fails on every PR since ~2026-08-11 with
"InvalidDistribution: '2.5' is not a valid metadata version": the
unpinned hatchling build backend now emits Metadata-Version 2.5, but
build-and-inspect-python-package v2 bundles a twine that predates it.
Bump the action to v3.0.1, which ships Twine 7 with metadata 2.5
support, pinned by commit hash per the action's v3 tagging policy (it
no longer force-updates major-version tags).

2. The Read the Docs build intermittently fails at "asdf global uv
latest" with "No compatible versions available": the asdf recipe from
the RTD docs resolves "latest" via a GitHub API scrape that flakes on
RTD's shared builders, and floats the uv version besides. Install uv
from PyPI, pinned, instead.

Assisted-by: ClaudeCode:claude-opus-4.8

Author: d-v-b

.github/workflows/cd.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: hynek/build-and-inspect-python-package@v2
+      - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
 
   publish-testpypi:
     needs: [dist]

.readthedocs.yaml

@@ -9,9 +9,10 @@ build:
     python: "3.13"
   jobs:
     install:
-      - asdf plugin add uv
-      - asdf install uv latest
-      - asdf global uv latest
+      # Install uv from PyPI, pinned. The asdf recipe from the Read the Docs
+      # docs resolves "latest" via a GitHub API scrape that intermittently
+      # fails on RTD's shared builders, and floats the uv version besides.
+      - pip install uv==0.12.3
       - uv sync --group docs
     build:
       html: