Review findings:
- UV_FIND_LINKS / extra-index env vars or a uv.toml could redirect the
install to a local build and false-pass the gate; now --no-config on
every uv call and refuse to run when an index-redirecting var is set
- an sdist fallback would build with backends fetched from TestPyPI;
install the package with --only-binary :all:
- show the package install (no -q) so the log records what was installed
- changelog: note the removed [dev] extra
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
