Force uv-managed Python in release build

The runner's system CPython 3.12.3 satisfies the '3.12' request, so uv
kept using it and PyInstaller failed: system python is built without
libpython3.x.so. Set UV_PYTHON_PREFERENCE=only-managed and install the
managed interpreter explicitly.

.gitea/workflows/ci.yml

@@ -35,14 +35,19 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+    env:
+      # Force uv-managed CPython: the runner's system python satisfies the
+      # "3.12" request but is built without libpython3.x.so, which
+      # PyInstaller --onefile requires.
+      UV_PYTHON: "3.12"
+      UV_PYTHON_PREFERENCE: only-managed
     steps:
       - uses: actions/checkout@v4
 
       - uses: astral-sh/setup-uv@v5
-        with:
+
-          # Pin uv's managed CPython: the runner's system python lacks
+      - name: Install managed Python
-          # libpython3.x.so, which PyInstaller needs for --onefile builds.
+        run: uv python install 3.12
-          python-version: "3.12"
 
       - name: Install dependencies
         run: uv sync --frozen --group build