update toolkit

[ks6088ts]

What this PR does / why we need it

• ...

Which issue(s) this PR fixes:

Fixes #247

Does this introduce a breaking change?

[ ] Yes
[ ] No

Pull Request Type

What kind of change does this Pull Request introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Get the code

ORGANIZATION=<organization-name>
REPOSITORY=<repository-name>

git clone git@github.com:$ORGANIZATION/$REPOSITORY.git
cd $REPOSITORY

• Test the code

make ci-test

What to Check

Verify that the following are valid

• ...

Additional Information

[Copilot]

Copilot review overview

🔵 Needs a closer look

Three unresolved moderate findings concern uv version enforcement, prek adoption validation, and mandatory zizmor gating.

Review effort: Lite
Findings: 1

Open (1)

• Adopt prek only after comparing hooks and measuring cache impact · New

What changed in this PR

Updates the Python template’s dependency tooling, CI coverage, hooks, Docker tooling, and deployment workflows.

Changes:

• Pins uv, Actions, Docker tools, and dependencies.
• Adds Python 3.10–3.14 testing and updated hook tooling.
• Refines dependency groups and deployment workflows.

File	Description
uv.lock	Locks updated dependencies and tooling.
README.md	Documents setup and validation commands.
pyproject.toml	Defines dependency groups and tooling.
Makefile	Updates installs, hooks, linting, Docker, and docs targets.
Dockerfile	Uses pinned uv and locked exports.
.pre-commit-config.yaml	Updates Ruff hooks.
.github/​workflows/​test.yaml	Adds compatibility and hook jobs.
.github/​workflows/​github-pages.yaml	Pins documentation deployment tooling.
.github/​workflows/​ghcr-release.yaml	Pins container release actions.
.github/​workflows/​docker.yaml	Updates Docker CI invocation.
.github/​workflows/​docker-release.yaml	Pins Docker release actions.
.github/​workflows/​azure-static-web-app.yaml	Uses least-privilege prebuilt deployment.
.github/​dependabot.yaml	Adds Docker and pre-commit updates.
.devcontainer/​devcontainer.json	Pins uv in the devcontainer.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.