The release-preparation workflow exposes a contents- and
pull-request-write `GITHUB_TOKEN` while running `rooster`.
`rooster@0.1.1` was pinned, but `uvx` still resolved its transitive
dependencies at runtime, so code outside the repository lock could
execute with that token.
Add a dedicated Python 3.12+ `release` dependency group containing
`rooster==0.1.1`, commit its full dependency graph to `uv.lock`, and
invoke it with `uv run --locked --python 3.12 --only-group release`.
Zsolt Dollenstein
16a9cec5da