fix: validate the published SDK dependency

[FanouZeng-TT]

Description

A standalone conformance checkout cannot follow the README's uv sync setup: [tool.uv.sources] redirects ucp-sdk to an absent ../python-sdk/ sibling. Ignoring that local source still installs the stale ucp-sdk==0.3.0, whose generated models cannot import the current 2026-04-08 conformance suite.

This updates the published dependency to ucp-sdk==0.4.4, the current SDK release for UCP 2026-04-08, while retaining the editable sibling source for coordinated local development. CI now also resolves dependencies with --no-sources, so the standalone published-package path cannot silently drift again.

Testing

• uv sync --no-sources --no-install-project in an isolated archive
• imported all 17 *_test.py modules against ucp-sdk==0.4.4
• full reference-server suite: 15 modules passed; the two webhook modules remain blocked by the known FastAPI response-model issue fixed in open PR fix: disable response model for mock webhook route #88
• uv run ruff check .
• uv run ruff format --check .
• uvx pre-commit run --all-files --show-diff-on-failure
• git diff --check

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new warnings
• New and existing tests pass locally, except for the documented pre-existing webhook blocker in fix: disable response model for mock webhook route #88

[FanouZeng-TT]

The new mandatory zizmor check flagged the four tag-based actions in the workflow modified here. I pinned the three actions/checkout uses and astral-sh/setup-uv to the commits behind their existing versions, then reran all pre-commit hooks and verified each SHA against its upstream tag.