[gaborbernat]

Fixes from an adversarial review of 5.0.1.

A new Nab release would fail every committed lock. Nab writes its own version into [tool.nab] nab-version, and check mode installed the newest cooled Nab, so from seven days after any Nab release every PR and tag run failed until the weekly refresh landed. Check mode now installs the Nab version the committed pylock.toml records; refresh mode still takes the newest cooled release, and nab-git-commit keeps its git install in both.

The caller's uv configuration could change where gw's own tools come from. A [tool.uv] index-url, a uv.toml or UV_INDEX_URL redirected install_live_tools.sh, so a PR could swap the Nab that checks its own lock. The script now ignores repository config and index variables, as cooled_prek.sh already does.

validate-news let a PR delete pylock.toml while nab.toml still configures it. The guard now covers nab.toml too.

Also: the test fixtures lose the groups 5.0.0 removed, a plain tox p installs release-creator and prek from the test group instead of relying on a separate install, and the README names the workflow_dispatch tag input that check-tagged-source reads.