Adopt PEP 723 script metadata, uv build, and a .python-version file

[tpvasconcelos]

Description

Three more items from the uv adoption tracked in #219, stacked on top of #388 (this PR targets the 219-dependency-groups branch and should auto-retarget to main once #388 merges).

PEP 723 inline script metadata (the "Script dependencies" item):

• cicd_utils/cicd/scripts/extract_latest_release_notes.py now declares its own dependencies as PEP 723 inline metadata, with a #!/usr/bin/env -S uv run --script shebang, so it can be executed standalone.
• The release-notes tox env becomes a thin wrapper around uv run --no-project --script ... (no more env dependencies to install), so tox -e release-notes and the release workflow keep working unchanged.
• The four markdown deps intentionally remain in the cicd_utils dependency group as well: the unit tests in tests/cicd_utils/test_scripts/ import the script's functions and need them importable in the test env. Both places carry cross-referencing comments.
• The shebang test in test_scripts_are_executable.py now also accepts the uv run --script form.
• open_in_browser.py was left alone - it is stdlib-only, so there are no dependencies to declare.

uv build: the build-dists tox env uses uv build instead of python -m build (dropping the build dependency; twine check --strict is kept). Also added skip_install = true since building dists doesn't require installing the package into the env - wheel installability is already covered by the test envs.

.python-version: pins the default dev interpreter to 3.10 (the lowest supported version, matching BASE_PYTHON in the Makefile and default_language_version in pre-commit), so plain uv venv/uv sync picks the right Python. Added to MANIFEST.in to keep check-manifest happy.

Locally validated: tox -e release-notes and tox -e build-dists both pass (twine check OK), and the full tests/cicd_utils suite passes (24/24).

Related issues

Related to #219. Stacked on #388.

PR check list

• Read the contributing guidelines.
• Provided the relevant details in the PR's description.
• Referenced relevant issues in the PR's description.
• Added tests for all my changes. (updated the shebang test; rest is CI config)
• Updated the docs for relevant changes. (N/A)
• Changes are documented in docs/reference/changelog.md.
• The CI check are all passing, or I'm working on fixing them!
• I have reviewed my own code! 🤠

---

📚 Documentation preview 📚: https://ridgeplot--392.org.readthedocs.build/en/392/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (ac819a3) to head (411d20e).

Additional details and impacted files

@@                   Coverage Diff                   @@
##           219-dependency-groups      #392   +/-   ##
=======================================================
  Coverage                 100.00%   100.00%           
=======================================================
  Files                         19        19           
  Lines                        674       674           
  Branches                      88        88           
=======================================================
  Hits                         674       674           

Flag	Coverage Δ
combined-src	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.