🔒️(ci) install dependencies without running their setup code

A package could run arbitrary code on the runner while installing,
and the versions were resolved rather than taken from the pins.
The two pip calls now take wheels only, and uv run no longer
resolves an environment of its own.

.github/workflows/meet.yml

@@ -33,7 +33,7 @@ jobs:
           ! git log | grep 'fixup!'
       - name: Install gitlint
         if: always()
-        run: pip install --user requests gitlint
+        run: "pip install --user --only-binary=:all: requests==2.34.2 gitlint==0.18.0"
       - name: Lint commit messages added to main
         if: always()
         run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
@@ -130,11 +130,11 @@ jobs:
         run: uv sync --locked --all-extras
 
       - name: Check code formatting with ruff
-        run: uv run ruff format . --diff
+        run: uv run --no-sync ruff format . --diff
       - name: Lint code with ruff
-        run: uv run ruff check .
+        run: uv run --no-sync ruff check .
       - name: Lint code with pylint
-        run: uv run pylint meet demo core
+        run: uv run --no-sync pylint meet demo core
 
   lint-agents:
     runs-on: ubuntu-latest
@@ -155,9 +155,9 @@ jobs:
       - name: Install the project
         run: uv sync --locked --all-extras
       - name: Check code formatting with ruff
-        run: uv run ruff format . --diff
+        run: uv run --no-sync ruff format . --diff
       - name: Lint code with ruff
-        run: uv run ruff check .
+        run: uv run --no-sync ruff check .
 
   lint-summary:
     runs-on: ubuntu-latest
@@ -175,7 +175,7 @@ jobs:
           python-version: "3.13"
           cache: "pip"
       - name: Install development dependencies
-        run: pip install --user .[dev]
+        run: "pip install --user --only-binary=:all: .[dev]"
       - name: Check code formatting with ruff
         run: ~/.local/bin/ruff format . --diff
       - name: Lint code with ruff
@@ -291,10 +291,10 @@ jobs:
           sudo apt-get install -y gettext
 
       - name: Generate a MO file from strings extracted from the project
-        run: uv run python manage.py compilemessages
+        run: uv run --no-sync python manage.py compilemessages
 
       - name: Run tests
-        run: uv run pytest -n 2
+        run: uv run --no-sync pytest -n 2
 
   test-summary:
     runs-on: ubuntu-latest
@@ -334,7 +334,7 @@ jobs:
           cache: "pip"
 
       - name: Install development dependencies
-        run: pip install --user .[dev]
+        run: "pip install --user --only-binary=:all: .[dev]"
 
       - name: Run summary tests
         run: ~/.local/bin/pytest