[STESOL-571] Locked and linted embedding generation inputs

[brikin01]

This is PR 1 of 2 addressing STESOL-571.

A lot of files are changed by this PR, but many are just linting. In particular, changes to the following are linting-only:

• discover-developer-arm-com-sources.py
• document_chunking.py
• generate-chunks.py
• tests/*.py

The changes to eval_questions.json and server.json are from PRs that landed in main but not yet secure-build.

Summary

• Adds a standalone Python 3.13 uv project and lockfile for embedding generation.
• Uses public PyPI and the PyTorch CPU index, with Linux AMD64 and ARM64 environments validated by uv.
• Pins the embedding model to a specific Hugging Face revision and adds a dedicated acquisition script.
• Requires vector generation and retrieval evaluation to load the acquired model from a local path.
• Disables network access during the Docker vector-generation step.
• Adds Ruff checks, including UP006 and UP035, to the existing embedding CI workflow.
• Enables embedding CI for pull requests targeting secure-build.
• Keeps the existing MCP runtime unchanged.

Scope

• This PR establishes the locked dependency and model-loading foundation.
• Follow-up PR will build the generator from uv.lock, separate acquisition from offline generation, and publish the model and embeddings together as a digest-addressed artifact.

[Copilot]

Pull request overview

This PR lays the groundwork for reproducible/offline embedding generation by introducing a locked Python environment and forcing both vector generation and retrieval evaluation to use a locally acquired, revision-pinned embedding model (with network disabled during the vector-generation step).

Changes:

• Adds a standalone uv-managed Python 3.13 project configuration for embedding generation (plus new ignore rules for generated artifacts).
• Pins the sentence-transformer model to a specific Hugging Face revision via a lock file and introduces an acquisition script; updates generation/eval flows to load from a local model path.
• Tightens CI for embedding-generation by adding Ruff checks and enabling the workflow on secure-build PRs.

Reviewed changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
mcp-local/server.json	Bumps published MCP server version and container tag reference.
embedding-generation/tests/test_vector_db_sources.py	Lint-only formatting changes.
embedding-generation/tests/test_generate_chunks.py	Lint-only formatting changes.
embedding-generation/tests/conftest.py	Lint-only formatting changes.
embedding-generation/run-question-eval.sh	Switches eval flow to acquire and use a local locked model directory; sets offline env for generation/eval.
embedding-generation/README.md	Updates local usage to uv + local model acquisition/offline generation steps.
embedding-generation/pyproject.toml	Introduces uv project metadata, dependency groups, Ruff config, and required environments.
embedding-generation/local_vectorstore_creation.py	Requires --model-path and forces local-only model loading for embedding creation.
embedding-generation/generate-chunks.py	Lint pass + source handling tweaks; continues chunk generation/discovery behavior.
embedding-generation/evaluate_retrieval.py	Switches evaluation from --model-name to required --model-path.
embedding-generation/eval_questions.json	Updates a couple of evaluation question strings.
embedding-generation/embedding-model.lock.json	Adds locked model identifier + exact revision SHA.
embedding-generation/document_chunking.py	Lint/typing modernization (PEP 585, collections.abc).
embedding-generation/Dockerfile	Adds model acquisition step and disables network during vector generation; passes --model-path.
embedding-generation/discover-developer-arm-com-sources.py	Lint/typing modernization.
embedding-generation/acquire-model.py	Adds a dedicated script to download the locked model revision and save a local copy.
embedding-generation/.python-version	Declares Python 3.13 for embedding-generation tooling.
arm_kb_search/resources.py	Adds support for loading embedding models via an explicit local path (and disables downloads when provided).
.gitignore	Ignores embedding-generation caches and generated artifacts.
.github/workflows/embedding-unit-tests.yml	Adds Ruff linting and enables workflow for secure-build branches/PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.