[gaborbernat]

Changes

• Recognize a GitHub Actions run with no linked PR when its source repository, branch, commit, and workflow match a fork or same-repository PR. Keep the seven-day observation and PR-opened-time checks.
• Require tagged releases to prove each new frozen hook revision came from a merged PR and has seven days of GitHub-observed age. Check the exact run-head configuration and use the merge timestamp when the merge itself is old enough.
• Pin the shared lock resolver to hash-checked uv 0.13.5 and update setup-uv to v10.3.2. Refresh the direct resolver pin with the weekly lock update.
• Check primary, optional native uv.lock, and secondary Nab locks before preparing or building a release. Pass native-lock selection through the weekly updater and its writer allowlist.

Validation

• tox r -e test: 799 passed; 100% statement and branch coverage for tools/.
• tox r -e type, prek run --all-files, and release-creator locks --check passed.
• Focused real-git/API cases cover fork and same-repository runs with empty PR links, exact tag streams, merged side-branch releases, direct hook pushes, force-pushed 404 heads, and stale lock inputs.

Rollout

Consumer workflows must repin this released Action version together. Tagged source jobs need full checkout history and actions: read, contents: read, and pull-requests: read for the hook proof. Repositories with a committed native or secondary lock must pass the corresponding check inputs.