ci: use locked Ruff in Python workflows - #162

Summary

• run Ruff through each project's existing uv environment instead of downloading an unpinned release with uvx
• enforce the committed lockfiles with --frozen in both Python lint workflows
• declare read-only workflow permissions and pin third-party actions to immutable commits, as required by the repository's zizmor policy

This keeps CI reproducible and prevents new Ruff releases from making untouched code fail before the repository deliberately updates its lint dependency.

Verification

• reproduced the failure on current main with Ruff 0.16.1: 99 findings in python/x402_a2a and 20 in python/examples/adk-demo
• uv run --frozen --group lint ruff check --output-format=github . passes in both directories with locked Ruff 0.13.1
• uv run --frozen --group lint ruff format --check . passes in both directories
• zizmor 1.25.2 at the repository's CI digest: no findings on either changed workflow
• git diff --check