V3 Astral uv Python toolchain capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local uv CLI ingredient exposes bounded project operations for readiness, lockfile freshness checks, dependency tree inspection, requirements export, CycloneDX SBOM generation, dependency vulnerability audit, and pytest execution through uv. Project operations run from an explicit project directory cwd supplied at execution time through the native cli_invocation cwd field, avoid caller-supplied uv flags, avoid shell wrappers, and keep diagnostics visible as text or JSON output. Lock, tree, and export operations use locked/check/offline/no-Python-download modes and never write the lockfile or sync the environment. Dependency audit is approval-gated because package inventory is sent to the fixed OSV advisory service. Test execution is approval-gated because pytest imports and executes project code in the discovered uv environment. Requires uv on PATH.