uv: lower bounds of satisfied >= ranges bumped for private library packages after v0.371.0

## Summary

Since approximately April 23, 2026 (dependabot-core v0.371.0), Dependabot uv updates modify `pyproject.toml` lower bounds in addition to updating `uv.lock`. For private library packages, this behavior persists even though PRs #14709 and #14747 intended to fix library misclassification.

## Observed behavior

Previously (through early April 2026), monthly uv Dependabot PRs only updated `uv.lock`. Starting with a PR opened May 4, 2026, Dependabot also bumps lower bounds in `pyproject.toml`:

```diff
- "some-dep>=1.0.0,<2.0.0",
+ "some-dep>=1.5.0,<2.0.0",
```

The existing upper bounds are correct and intentional (semver compatibility). The lower bounds represent the minimum version the library supports — bumping them silently raises the minimum requirement for downstream consumers.

## Expected behavior

For library packages, only `uv.lock` should be updated. `pyproject.toml` lower bounds should not be changed.

## Root cause hypothesis

PR #14666 fixed `BumpVersions` to actually bump lower bounds of `>=` range requirements that already satisfy the new version. This is correct behavior for applications but incorrect for libraries. PRs #14709 and #14747 attempted to fix the library misclassification by falling back to the `description` field in `pyproject.toml` when the package is not found on PyPI. Both fixes are confirmed live as of v0.371.0.

However, the regression persists. The affected package is:
- **Not on PyPI** (private package, published to a private index)
- **Has a `description` field** in `pyproject.toml` (e.g. `description = "My Python Library"`)
- **Has `versioning-strategy: increase-if-necessary`** in `dependabot.yml` (added after observing the regression — this should also prevent lower-bound bumps, but appears ineffective for the uv ecosystem)

## Reproduction

`pyproject.toml` (relevant excerpt):
```toml
[project]
name = "my-library"
description = "My Python Library"
dynamic = ["version"]
requires-python = ">=3.10, <4"
dependencies = [
"some-dep>=1.0.0,<2.0.0",
]
```

`.github/dependabot.yml`:
```yaml
- package-ecosystem: "uv"
directory: "/"
registries:
- my-private-registry
schedule:
interval: "monthly"
versioning-strategy: increase-if-necessary
groups:
all:
patterns:
- "*"
```

The private index returns 404 for the package name when Dependabot checks PyPI, so the fallback in #14709/#14747 should apply — but the lower bounds are still being bumped.

## Version

dependabot-core v0.371.0+ (confirmed in v0.373.0 as well)

## Related

- #14666 — root cause (BumpVersions now actually bumps lower bounds)
- #14709 — attempted fix (library detection fallback to description field)
- #14747 — follow-up fix (same area)
- #12162 — uv versioning-strategy support appears incomplete