fix(uv): use astral urls for uv primary source, github as secondary

[jwnimmer-tri]

For official releases, use the astral.sh mirror as the preferred url for binary downloads, with github.com as a fallback.

For uv >= 0.11.0, read the checksums directly from the dist-manifest contents, so the only github.com SPOF is fetching the dist-manifest itself.

---

It is not infrequent for github.com to give a 5xx error on one of the uv sha256 downloads, leading to a failed build. (The sha256 downloads cannot be cached by Bazel's repository cache, since we request them without a checksum.) See RobotLocomotion/drake#24140 for some examples, as well as bazelbuild/bazel-central-registry#8591 (comment) (log).

This change limits github as a single point of failure.

[gemini-code-assist]

Code Review

This pull request enhances uv download reliability by introducing the astral.sh mirror as a preferred download source for official releases and optimizing checksum retrieval for uv versions 0.11.0 and later by reading them directly from the manifest. A review comment identifies that the mirror fallback should also be applied when downloading checksum files for older uv versions to ensure consistent availability.

[rickeylev]

Thanks for this! TIL astral has mirrors.

Overall LGTM, just some word smithing of the PR and and changelog text to make: replace "improve ..." with "make uv use astral urls as primary, github as backup"

its not infrequent for github to give 500 errors

omg, i know right? It's been so bad lately.

would we like manifest_file_integrity = ... added as an option to the module extension.

Absolutely, yes.

[jwnimmer-tri]

Thanks!

I'll open a tracking issue about the manifest_file_integrity feature later today and work on it time permitting.

And lol, the windows CI build hit a github 5xx downloading a standalone cpython. Possibly those could use the astral mirror as well? I didn't look into that angle (and generally don't use those toolchains).

[aignas]

We could write the dist manifest sha to the facts file.