Enforce the configured uv version in local recipe guards

[acgetchell]

Summary

Make every local uv-backed recipe enforce the configured uv 0.12.1 pin instead of checking only that an arbitrary uv executable is present.

Current State

• uv_version is configured as 0.12.1.
• setup-tools verifies that exact version.
• _ensure-uv checks only command presence.
• _ensure-actionlint duplicates the presence-only check rather than reusing _ensure-uv.
• Normal validation recipes can therefore run under a different uv version even though setup and CI establish a canonical pin.

Proposed Changes

• Update _ensure-uv to compare the installed version with uv_version and report the expected and actual versions clearly.
• Make _ensure-actionlint depend on _ensure-uv and retain its actionlint availability check.
• Keep setup-tools as the installation and full verification path.
• Add or extend focused recipe tests if the repository has an established Justfile test harness.

Benefits

• Local validation and CI use the same uv release.
• Version drift fails immediately with actionable guidance.
• The uv version check has one implementation instead of divergent guards.

Implementation Notes

Reuse uv_version rather than adding another literal. Preserve all existing recipe commands and locked-environment behavior.