COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
(We'd recommend pinning the version or SHA in production)