🛡️ protect against python supply chain attacks

[rafaelleinio]

Note

Low Risk
Low risk because changes are limited to documentation and dependency resolution configuration, with no runtime code impact aside from potentially pinning slightly older package versions during installs.

Overview
Adds a Dependency management section to README.md describing use of uv, the committed uv.lock, and the rationale for a supply-chain mitigation cooldown.

Updates pyproject.toml to configure uv with exclude-newer = "7 days", preventing installs from selecting packages published within the last week.

^{Written by Cursor Bugbot for commit af33f70. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}