fix(ci): provision uv for Prime artifact graduation

.github/workflows/prime-artifact-graduation.yml

@@ -142,6 +142,13 @@ jobs:
             "$PYLON_PRIME_STOCK_TARBALL"
           test -x "$PYLON_PRIME_AGENT_STOCK_ARTIFACT_BIN"
 
+      - name: Set up the Python kernel bootstrap prerequisite
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          version: "0.9.26"
+          checksum: "30ccbf0a66dc8727a02b0e245c583ee970bdafecf3a443c1686e1b30ec4939e8"
+          enable-cache: false
+
       - name: Run real bridge, managed store, restart, crash-receipt, and native multi evidence
         run: |
           set -euo pipefail

docs/operations/prime-artifact-graduation.md

@@ -61,6 +61,11 @@ the preview with the server-owned Sigstore and frozen source policy before a pre
 extracted, imported, or executed. The production managed tool store then installs the bundled CLI
 without a package manager or lifecycle script.
 
+The native background-command proof starts a real IPython kernel. The workflow installs a pinned,
+checksum-verified `uv` bootstrap prerequisite before running the proofs; a clean runner cannot rely on
+a developer machine's `uv` installation. Prime then provisions Python in the isolated fixture home.
+This does not enable package lifecycle scripts for managed Prime installation.
+
 The cases cover stock and signed-preview bridge capability, side-by-side installation, real start/use,
 update or exact no-op, rollback, stock switch-back, unchanged stock bytes, receipt-owned-only cleanup,
 repeated Pylon restart/crash receipt recovery, and native multiple-instance evidence. The native multi