Refactor CI/CD Github actions

[vkehfdl1]

Like using tox and optimized to uv

[shaun0927]

While the CI is being reshaped around tox and uv, two small hardening touches would be worth bundling:

1. Pin the third-party actions in `.github/workflows/*.yml` to commit SHAs instead of floating tags (`@v4`, `@v5`). `publish.yml` carries `secrets.PYPI_TOKEN`, so a compromised-and-retagged action would have release-signing reach; SHA pins contain the blast radius to whatever was merged into this repo.
2. Scope `OPENAI_API_KEY` to the single step that needs it in `test.yml` rather than setting it at the workflow-`env` level. CONTRIBUTING.md already notes that the key is not required in CI, so in practice the workflow-level exposure only matters if a third-party action gets added to the job later — moving to step-level scoping removes that footgun.

Both are mechanical diffs that fit naturally inside the broader refactor; happy to send a PR targeting the same branch if it helps.