chore(ci): SHA-pin astral-sh/setup-uv in test-release-pypi

[MAfarrag]

Context

Security review (consistency with the SHA-pinned uv action); fixed in PR #28.

Problem

.github/workflows/test-release-pypi.yml used astral-sh/setup-uv@v7 (mutable tag) while the uv action itself pins
@11f9893… # v8.3.2.

Affected locations

File	Location
.github/workflows/test-release-pypi.yml	two uses: astral-sh/setup-uv@v7

Fix (PR #28)

Pinned both occurrences to 11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2.

Severity / Effort

Low · XS

Definition of Done

• No setup-uv@v7 tag reference remains