fix(ci): resolve release deps from PyPI, not just TestPyPI

[Facundo Santiago (santiagxf)]

Problem

The pre-release-checks job in _release.yml installs the freshly built package to smoke-test it before publishing:

uv pip install \
  --extra-index-url https://test.pypi.org/simple/ \
  "$PKG_NAME==$VERSION"

The comment claimed PyPI is the primary index and TestPyPI is only a fallback. That assumption is wrong for uv:

• uv gives --extra-index-url indexes higher priority than the default index, and
• uv's default --index-strategy is first-index, which pins each package to the first index that contains it and never looks further.

So for a dependency like aiohttp, uv checks TestPyPI first, finds only an old version there (e.g. aiohttp==3.8.1 from the shared TestPyPI namespace), pins to that index, and never falls back to PyPI's 3.14.x. Resolution fails with:

No solution found ... only aiohttp==3.8.1 is available and
langchain-azure-ai==1.2.8 depends on aiohttp>=3.14,<4.dev0

This is inherently fragile — any dependency that happens to exist on TestPyPI at an incompatible version breaks the release.

Fix

Add two flags to the three uv pip install invocations that use TestPyPI:

• --index-strategy unsafe-best-match — the real fix. uv considers all indexes for every package and picks the best compatible version, so deps come from PyPI while the just-uploaded PKG==VERSION comes from TestPyPI. This is the pattern uv documents for combining PyPI + TestPyPI.
• --prerelease=allow — silences the misleading pre-release hint uv emits for compatible-release specifiers (aiohttp~=3.14 normalizes to >=3.14,<4.dev0, whose .dev0 upper bound trips uv's pre-release detection). Matches upstream LangChain's release workflow.

The stale comment is updated to reflect uv's actual index-priority behavior.

Notes

• --index-strategy unsafe-best-match relaxes dependency-confusion protection, but this is the documented approach for the PyPI + TestPyPI smoke test. The job holds no publishing credentials — id-token: write lives only in the separate publish job, which is untouched.
• uv sync and the min-version steps don't use TestPyPI and are unaffected.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com