build: track devcontainer images via dependabot

[tamtamchik]

Follow-up to #165.

What and why

• Docker block in dependabot.yml (directory: /.devcontainer) tracks both devcontainer images. Dependabot's Docker parser reads version references only from literal FROM lines, so both the base image (mcr.microsoft.com/devcontainers/python:3.11) and the uv image sit on their own FROM line. The base image builds and runs in regression.yml, inside the trusted verification path.
• uv comes from Astral's official image as a FROM … AS uv stage; COPY --from=uv then lifts the /uv and /uvx binaries. This replaces pip install uv==… and pins the uv version in one place (Dockerfile) instead of three (Dockerfile, devcontainer.json, regression.yml).

Both bullets close the open follow-ups from the #165 review: the docker block and the UV_VERSION drift.

uv image safety

• We already trusted Astral for the uv wheel on PyPI. This pulls the same vendor's binary over a different channel.
• The Dockerfile pins the image by digest (@sha256:10902f…), like the base image. That beats the old pip install uv==… running without --require-hashes.
• COPY --from=uv copies only the static /uv and /uvx binaries; the source image's OS layers stay out of the runtime.
• Each platform image carries an attestation manifest (SLSA build provenance plus SBOM). Verify it with gh attestation verify oci://ghcr.io/astral-sh/uv:0.10.9 --owner astral-sh.

[Copilot]

Pull request overview

This PR updates the devcontainer build to pin and track both the devcontainer base image and the uv binary via Docker FROM lines, enabling Dependabot’s Docker ecosystem updates and removing duplicated UV_VERSION pinning across config/workflows.

Changes:

• Add a Dependabot docker ecosystem entry for /.devcontainer to track Docker FROM image references.
• Switch .devcontainer/Dockerfile from pip install uv==... to copying uv/uvx from Astral’s official uv image (pinned by digest).
• Remove UV_VERSION propagation from regression.yml and devcontainer.json since it’s now pinned in the Dockerfile.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/regression.yml	Removes UV_VERSION env/build-arg usage so CI builds rely on the Dockerfile-pinned uv stage.
.github/dependabot.yml	Adds Docker ecosystem scanning for /.devcontainer to keep devcontainer image references updated.
.devcontainer/Dockerfile	Introduces a dedicated uv stage pinned by digest and copies the binaries into the final devcontainer image.
.devcontainer/devcontainer.json	Removes build args for base image / UV_VERSION, relying on Dockerfile pinning instead.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.