[gaborbernat]

Routine CI hygiene for the release and workflow setup, plus adoption of the shared tox-dev/github-workflows 6.5.0 check, CodeQL and release workflows.

Hygiene:

• Pin every tox-dev/github-workflows reference, including the untagged scorecard pin, to 6.4.0. Nothing in 6.2.2 through 6.4.0 renames or removes an input these callers pass.
• Align astral-sh/setup-uv to v10.3.3.
• Drop the [tool.nab] release-creator exception, which was marked for deletion after 2026-11-02. pylock.toml regenerated with nab 0.0.23, the version it records.

Adoption:

• Pin every reference to 6.5.0.
• check.yaml passes the tox matrix to the reusable workflow as include. The caller keeps the 🧪 Test job and the 🚦 Required checks pass gate, which now calls the required-checks action instead of an inline jq expression. Tox installs under the 7-day upload cutoff, as the shared workflow does for every repository.
• codeql.yaml runs the analysis through the reusable workflow. The caller keeps its triggers and the tests path exclusion.
• Release: release-notes.yaml renders the GitHub Release body, and github-release.yaml verifies the PyPI files before it creates the Release. The PyPI publish job stays in the caller for trusted publishing. This replaces the local notes upload, previous-tag, reconcile and Release steps.

Required checks are unchanged: 🚦 Required checks pass, 📝 News fragment and pre-commit.ci - pr keep their names. The test checks now read 🧪 Test / 🧪 <env> on ubuntu-26.04, and CodeQL reads 🛡️ Analyze / 🛡️ Analyze <language>.

Dependabot already covers github-actions and pre-commit with the 7-day cooldown, so no config change there.