ci: add 2-day package install cooldown (supply-chain guard)

[bhimrazy]

What does this PR do?

Adds a CI-only supply-chain guard: the resolver refuses any PyPI release published within the last 2 days, so typosquats and malicious uploads that get yanked within ~24h never land in our CI environment.

Sets UV_EXCLUDE_NEWER: "2 days" on the uv-based ci-testing workflow (the only uv-based workflow in this repo). pip-based workflows are out of scope for now.

Follows the same pattern as pytorch-lightning#21722.

Ref: https://docs.astral.sh/uv/reference/settings/#exclude-newer

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81%. Comparing base (5213544) to head (d991e84).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@         Coverage Diff         @@
##           main   #825   +/-   ##
===================================
  Coverage    81%    81%           
===================================
  Files        54     54           
  Lines      7617   7617           
===================================
+ Hits       6144   6147    +3     
+ Misses     1473   1470    -3     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.