ci(release): fix package verification and dependency updates

[tulayha]

Summary

• ignore publisher-generated .publish.attestation sidecars when verifying the exact TestPyPI wheel and sdist
• configure Dependabot for the repository's authoritative uv ecosystem instead of treating generated requirements as pip manifests
• generate and embed the desktop runtime constraints and their digest directly from frozen uv.lock during the desktop build
• remove the duplicated committed constraints artifact and CI freshness block

Validation

• reproduced the failed TestPyPI verification against the published 0.4.0.dev20 files and confirmed the corrected verifier reports an identical distribution set
• 9 focused published-distribution tests passed
• 25 release-contract and packaging tests passed
• Windows release-profile desktop crate: 72 tests passed with the pinned Rust and uv toolchains
• generated runtime manifest SHA-256 matches the embedded generated constraints
• Rust formatting and git diff --check passed

Both commits use ci/build types and do not add release-note entries or bump the product version.