Run Python CI tests against the committed uv.lock #2497

Observed gap

The test (Python 3.11) and test (Python 3.12) jobs on main check uv.lock with uv lock --check, then install .[dev,youtube] using pip. Those installs resolve independently of uv.lock. A lockfile-only update such as PR #2486 can therefore receive green Python tests without those tests running against its proposed package versions. PR #2486 has a separate failing dependency-review check; this issue does not claim that check is fixed.

Required behavior

• Keep the existing Python 3.11/3.12 matrix, unit-test selection, coverage settings, offline MCP regressions, and failure behavior.
• Install the project with its dev and youtube extras from the exact committed uv.lock for each matrix interpreter.
• Run both Python test steps through that installed environment so a lockfile update is actually exercised.
• Verify the change on hosted Linux for both matrix versions before treating it as complete. Do not merge a dependency update solely because the lockfile parses or unrelated tests pass.

Candidate and current evidence

An isolated two-file candidate changes the install step to uv sync --locked --python "${{ matrix.python-version }}" --extra dev --extra youtube, runs both test steps with .venv/bin/python, and updates the workflow-governance test to enforce the order and environment. Its local uv sync --locked completed on Python 3.11 and 3.12. With two unrelated, existing tests that fail on this macOS host excluded, the local unit gate passed on each interpreter: 2,966 passed, 11 deselected, 5 xpassed, and 118 subtests. The offline MCP regressions passed: 38 tests and 20 subtests on each interpreter. These are local results; hosted CI and the real PR #2486 dependency comparison are still pending.