ci: fix distribution metadata check and pin uv in docs build

[d-v-b]

🤖 AI text below 🤖

Two unrelated CI breakages, both rooted in unpinned tooling. Together they account for every red check on #20 that isn't that PR's own content.

1. Distribution build: twine rejects Metadata-Version: 2.5

Every PR since ~Aug 11 fails with InvalidDistribution: '2.5' is not a valid metadata version (first seen on the Aug 11 dependabot run). The unpinned hatchling build backend now emits Metadata-Version 2.5; hynek/build-and-inspect-python-package@v2 bundles a twine that predates it. The action's v3.0.0 release notes name the fix directly: "Only updates of actions and build dependencies, notably including Twine 7 that adds support for packaging metadata 2.5."

Bumped to v3.0.1, pinned by commit hash — required by the action's own v3 policy, which stops force-updating major-version tags (@v3 doesn't exist). Also drops zizmor's unpinned-uses finding for this line.

2. Read the Docs: asdf global uv latest flakes

The RTD build for #20 died at asdf global uv latest → No compatible versions available (uv [0-9]). That's the asdf uv plugin's version scrape (a GitHub API call from RTD's shared, rate-limited builders) returning nothing — a network lookup unrelated to the docs, and it floats the uv version besides. Replaced the three asdf lines with pip install uv==0.12.3: one pinned dependency from PyPI, which the build already needs for uv sync.

Verification

• prek hooks for both files pass (Validate GitHub Workflows, Validate ReadTheDocs Config, prettier)
• zizmor on cd.yml: 12 findings vs 13 on main — one improvement, no new findings
• The RTD build on this PR exercises the .readthedocs.yaml change directly; the cd.yml change is exercised by this PR's own Distribution build job

[codspeed-hq]

Merging this PR will not alter performance

✅ 48 untouched benchmarks

---

_{Comparing ci/fix-dist-build-and-pin-uv (59f7f75) with main (7d28da9)}