chore: add uv audit to CI workflows

[Copilot]

Summary

Add dependency auditing to the CI workflows that resolve or package Python dependencies. This makes dependency malware/vulnerability checks a first-class CI gate across validation and release paths.

Changes

• CI dependency audit gates

  • Added uv audit --locked to the main validation workflow after dependency installation.
  • Added the same audit gate to docs, PyPI publish, Docker publish, and benchmark workflows where dependencies are resolved or exported.

• Scope

  • Covers both PR-time and release-time pipelines, so audits run before lint/test/doc build, package build, and image publication steps.

• Workflow pattern

  - name: Audit dependencies
    run: uv audit --locked

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!