Regenerate Harbor uv.lock files against public PyPI

🤖 Reported by Codex during the public-release documentation audit.

## Summary

The Harbor benchmark lockfiles contain package sources and artifact URLs for Block's internal Artifactory mirror instead of public PyPI:

- `benchmarks/harbor-buzz-orchestra/uv.lock`: 1,589 references to `global.block-artifacts.com`
- `benchmarks/harbor-buzz-orchestra/testbed/uv.lock`: 1,645 references to `global.block-artifacts.com`

Neither adjacent `pyproject.toml` explicitly configures that index, so the lockfiles appear to have captured a developer-global `uv` configuration when they were generated.

## Impact

External contributors may be unable to run `uv sync --frozen` for these benchmark environments without access to Block's package mirror. The committed files also expose an organization-specific dependency endpoint that is not part of the open-source setup.

## Suggested fix

1. Regenerate both lockfiles in a clean environment with public PyPI explicitly selected, for example with `https://pypi.org/simple` as the default index.
2. Run `uv sync --frozen` for both projects from an environment without Block credentials or package-index configuration.
3. Consider adding a CI check that rejects organization-only package hosts in committed lockfiles.

## Acceptance criteria

- Neither lockfile contains `global.block-artifacts.com` or another private package host.
- Both benchmark environments install successfully with `uv sync --frozen` using public dependencies only.
- Existing benchmark tests still pass.