fix(ci): arm64 runner toolchain — pyrage aarch64 wheel + lane-shas via uv

The self-hosted Actions runner is aarch64 (Apple M1 Linux); the CI toolchain
assumed x86_64, so every workflow has been failing at environment setup — on
main and every PR, not a code regression.

Two root causes, both arm64:

  * pyrage==1.2.3 publishes no linux-aarch64 wheel, so uv fell back to an sdist
    build and modern uv rejects pyrage's own pyproject.toml ("[project] without
    project.version") — "TOML parse error at line 5". Bump to pyrage==1.2.4, the
    first release shipping a cp39-abi3 manylinux_2_17_aarch64 wheel (x86_64 and
    macOS wheels retained). No source build -> no parse error. Fixes smoke,
    full-pytest, contemplation, ratify-proposal.
    Verified: age/X25519 encrypt+decrypt round-trips on 1.2.4, and the committed
    sealed-holdout artifacts (sealed under 1.2.3) still decrypt
    (tests/test_holdout_encryption.py, tests/test_adr_0119_7_sealed_gsm8k.py —
    7 passed). No ADR pins the patch version; only a size-tally doc referenced
    it (updated).

  * lane-shas used actions/setup-python@v5, which has no arm64 build for the
    pinned 3.12.13 ("version '3.12.13' with architecture 'arm64' was not found"
    -> "python: command not found"). Switch to astral-sh/setup-uv@v5 + uv (uv
    provisions arm64 Python reliably), matching the other four workflows.

Files: pyproject.toml (pyrage 1.2.3->1.2.4), docs/model_dependency_size_tally.md,
.github/workflows/lane-shas.yml. uv.lock is gitignored (uv re-resolves per run).

Separate pre-existing issue (NOT addressed here): with setup fixed, lane-shas
now reaches its SHA check, where 2 demo lanes (demo_composition, public_demo)
drift from their pins. This is content drift on main, unrelated to the toolchain
(public_demo is a known wall-clock/env flake). Left for an explicit re-pin vs
degate decision rather than silently re-pinning.

.github/workflows/lane-shas.yml

@@ -33,32 +33,34 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: set up python
-        uses: actions/setup-python@v5
+      # setup-uv (not actions/setup-python) provisions Python on the aarch64
+      # self-hosted runner; actions/setup-python has no arm64 build for the
+      # pinned 3.12.13. Matches smoke.yml / full-pytest.yml.
+      - name: set up uv
+        uses: astral-sh/setup-uv@v5
         with:
           python-version: '3.12.13'
-          cache: 'pip'
+          enable-cache: true
 
       - name: install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -e . pyyaml pytest
+          uv pip install -e . pyyaml pytest
 
       - name: verify lane SHAs
         env:
           PYTHONPATH: ${{ github.workspace }}
         run: |
-          python scripts/verify_lane_shas.py
+          uv run python scripts/verify_lane_shas.py
 
       - name: verify CLAIMS.md is current
         env:
           PYTHONPATH: ${{ github.workspace }}
         run: |
-          python scripts/generate_claims.py --check
+          uv run python scripts/generate_claims.py --check
 
       - name: emit machine-readable report (on failure)
         if: failure()
         env:
           PYTHONPATH: ${{ github.workspace }}
         run: |
-          python scripts/verify_lane_shas.py --json || true
+          uv run python scripts/verify_lane_shas.py --json || true

docs/model_dependency_size_tally.md

@@ -100,7 +100,7 @@ learned-params tally above. Measure precisely with
 | `pytest-xdist` | >=3.6 | parallel tests | <1 MB |
 | `hypothesis` | >=6.152.7 | property tests | ~5 MB |
 | `psutil` | >=7.0 | process/resource probing | ~2 MB |
-| `pyrage` | ==1.2.3 | age encryption (Rust binding) | ~3 MB |
+| `pyrage` | ==1.2.4 | age encryption (Rust binding) | ~3 MB |
 | `pyyaml` | >=6.0 | config/manifest parsing | ~1 MB |
 
 > **Footprint note:** `datasets` dominates the Python install. If the GSM8K

pyproject.toml

@@ -11,7 +11,7 @@ dependencies = [
     "pytest-asyncio>=1.3.0",
     "pytest-xdist>=3.6",
     "psutil>=7.0",
-    "pyrage==1.2.3",
+    "pyrage==1.2.4",
     "pyyaml>=6.0",
     "ruff>=0.15.12",
     "datasets>=4.8.5",