build(uv): bump default uv to 0.13.1

[gfrankliu]

Scoped override-dependencies in [tool.uv], e.g.
{ package = { name = "a" }, dependencies = ["x>=1.0"] }, need uv 0.11.25 or
newer. The default uv (0.11.2) fails to parse them, so users of the lock
rule had to set uv.configure(version = ...) themselves. This bumps the
default and the dev uv to 0.13.1. It supports the same platforms as 0.11.2.

Before: a pyproject.toml with a scoped override passed to lock fails to
parse with the default uv.
After: it works without any uv.configure override.

Fixes #2992

[Copilot]

🔵 Needs a closer look

Release-artifact compatibility, platform support, and scoped-override behavior remain unverified.

0 open findings

What changed in this PR

Updates uv to 0.13.1 so the lock rule can support scoped dependency overrides without a user-supplied version override.

Changes:

• Bumps default, development, and integration-test uv versions.
• Adds a release note explaining scoped-override support.

File	Description
tests/​integration/​uv_lock/​MODULE.bazel	Updates integration-test uv to 0.13.1.
news/​2992.changed.md	Documents the version bump and scoped-override support.
MODULE.bazel	Updates default and development uv to 0.13.1.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gfrankliu]

Notes on what Copilot listed as unverified:

• Release artifacts: 0.13.1 downloads and runs via the dist manifest. //tests/uv/... (57 tests) and //tests/integration:uv_lock_test_bazel_self pass locally.
• Platforms: the 0.13.1 dist-manifest.json lists the same target triples as 0.11.2, so no registered platform loses a uv binary.
• Scoped overrides: I verified this outside this repo. A lock target with a pyproject.toml scoped override resolves as expected on 0.13.1, and a genuine conflicting requirement still fails resolution. There's no test for it here yet. @aignas, would you like me to add one under tests/uv/lock/ (scoped override in pyproject.toml plus a check of the expected output), or keep this PR to the version bump?

[aignas]

It's OK to not have a test for this because it is just a uv feature with which we have very loose coupling.