build: pin uv resolver with exclude-newer

Context

Now that we're on uv (#18), we can make dependency resolution reproducible by refusing to consider distributions published after a cutoff. See tool.uv.exclude-newer.

⚠️ Open question — this is not a rolling window

exclude-newer takes a fixed RFC 3339 timestamp, not "last 1 week." Options:

1. Pin a static date and bump it manually / on release.
2. Add a scheduled workflow that rewrites the date to today - 7d and opens a PR (true rolling week).
3. Rely on the UV_EXCLUDE_NEWER env var in CI only, leaving local dev unpinned.

Proposed tasks

• Decide static vs. automated rolling cutoff
• Add [tool.uv] exclude-newer to pyproject.toml
• (If rolling) add a scheduled workflow to bump the date
• Document the policy in CONTRIBUTING