ci: pin every floating image tag and the uv version

A floating tag is a live dependency on someone else's release button:
langfuse/langfuse:3 was repointed upstream today and reddened main and
every open PR with no code change.

Each image is pinned to the version tag its :latest digest already
resolves to, so these are freezes, not upgrades. debian is pinned to the
trixie codename rather than a digest because the ssh sandbox apt-installs
openssh-server.

setup-uv had no version input at any of its 17 call sites, so it floated
to latest and moved 0.12.8 -> 0.12.9 in a day.