Bump astral-sh/setup-uv to v10.2.0 (pinned by commit)

v10 runs on Node 24, removing the Node 20 deprecation warning. Upstream
stopped publishing major tags, so the action is pinned to the v10.2.0
release commit. The v7-v10 breaking changes (server-url and
manifest-file inputs, cache defaults for pull_request_target,
workflow_run and release) don't affect this workflow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: natrajexplore

.github/workflows/ci.yml

@@ -13,7 +13,8 @@ jobs:
         working-directory: backend
     steps:
       - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      # setup-uv no longer publishes major tags; pin the release commit (supply-chain safety)
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - run: uv sync --frozen
       - run: uv run pytest -q