Build releases with the pinned build backend and publish with an action that accepts current metadata

The release build ran uv 0.9.5, which does not apply
[tool.uv].build-constraint-dependencies to `uv build`, so the hatchling
pin in pyproject.toml never took effect there and the build floated to
hatchling 1.32.0, which writes Metadata-Version 2.5. The publish step was
pinned to gh-action-pypi-publish v1.14.0, whose metadata check predates
2.5 and rejected the distributions before upload.

Use uv 0.12.5 for the build job so the constraint applies (hatchling
1.29.0, Metadata-Version 2.4, matching what 2.0.0 shipped), and move the
publish action to v1.14.2, which also accepts 2.5.

No-Verification-Needed: workflow-only change; reproduced both builds locally

Author: maxisbey

.github/workflows/publish-pypi.yml

@@ -21,7 +21,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
-          version: 0.9.5
+          version: 0.12.5
 
       - name: Set up Python 3.12
         run: uv python install 3.12
@@ -57,7 +57,7 @@ jobs:
           path: dist/
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           # Lets a re-run after a partially failed upload publish the remaining
           # files instead of erroring on the ones already on PyPI.