[keep] Swap pip → uv in CI workflow(s)

[haasonsaas]

Summary

• test job in .github/workflows/ci.yml: collapse uv venv .venv + $GITHUB_PATH echo + uv pip install -r app/requirements.txt into the recipe form uv pip install --system -r app/requirements.txt.
• Pin the adjacent astral-sh/setup-uv (line 85 of the original) to 08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0.
• lint-and-format and security-scan jobs unchanged — they have no pip install to swap and their existing astral-sh/setup-uv@v7 references are out of scope for this PR.

Why

Aligns the test job's Python install with the resilience pattern landed in evalops/maestro-internal#1492 (uv resumes partial downloads + retries on connection drops, removing the pip read-timeout flake class).

Scope

• .github/ only. The Makefile install-tools target — which already invokes uv tool install black/flake8/isort/mypy and uv pip install -r app/requirements.txt — is intentionally out of scope here.
• No CLI-tool installs added in the workflow itself, so the 3-attempt UV_HTTP_TIMEOUT=120 wrapper from #1492 is not used in this diff.

Test plan

• CI workflow green on this PR (test job installs deps via uv pip install --system -r app/requirements.txt, then make install-tools, then make test against the postgres service).
• Confirm make install-tools' downstream uv pip install -r app/requirements.txt (Makefile:126) still completes — it now installs into system Python rather than the previously-active .venv.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Low risk CI-only change; main risk is dependency installation behavior changing from a venv to system Python within the test job, which could affect isolation or caching but not production runtime.

Overview
Updates the test job in .github/workflows/ci.yml to install Python dependencies via uv pip install --system -r app/requirements.txt instead of creating/activating a local .venv.

Pins astral-sh/setup-uv in the test job to commit 08807647e7069bb48b6ef5acd8ec9567f424441b (v8.1.0) for more reproducible CI runs.

^{Reviewed by Cursor Bugbot for commit 1af0e79. Bugbot is set up for automated code reviews on this repo. Configure here.}