Bump the base-images group across 1 directory with 2 updates

Bumps the base-images group with 2 updates in the / directory: [astral-sh/uv](https://github.com/astral-sh/uv) and library/python.


Updates `astral-sh/uv` from 0.12.18 to 0.13.0
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.18...0.13.0)

Updates `library/python` from `caaf356` to `a2b82f3`

---
updated-dependencies:
- dependency-name: astral-sh/uv
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: base-images
- dependency-name: library/python
  dependency-version: 3.14-slim-trixie
  dependency-type: direct:production
  dependency-group: base-images
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

Containerfile

@@ -26,10 +26,10 @@ ARG PACKAGE_INDEX=https://pypi.org/simple
 ARG DEBIAN_UPGRADE=true
 
 # uv, only to install the locked dependencies; it never reaches a final image.
-FROM ghcr.io/astral-sh/uv:0.12.18@sha256:3adc3706091ce7c2fe595e669628caedd6d951551b92b258b7e7dbe06d9440bc AS uv
+FROM ghcr.io/astral-sh/uv:0.13.0@sha256:cdc6093146eb3ff6a40107b38f008b789e050e77ad87865e381d9917da55a168 AS uv
 
 # Build: the tool and its locked dependencies, into a virtual environment at /opt/ldo.
-FROM docker.io/library/python:3.14-slim-trixie@sha256:caaf356f40667c496d405780745b9ac25771c189a51dfcc42430d531ea09f8a2 AS build
+FROM docker.io/library/python:3.14-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS build
 COPY --from=uv /uv /usr/local/bin/uv
 ENV UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy \
@@ -80,12 +80,12 @@ RUN --mount=type=secret,id=netrc,target=/root/.netrc \
 # same on every architecture for one Python version, and this is the same base image, so
 # the result is what compiling in place would give, in seconds rather than an hour.
 # unchecked-hash: the image never changes, so Python need not check the sources.
-FROM --platform=$BUILDPLATFORM docker.io/library/python:3.14-slim-trixie@sha256:caaf356f40667c496d405780745b9ac25771c189a51dfcc42430d531ea09f8a2 AS compile-az
+FROM --platform=$BUILDPLATFORM docker.io/library/python:3.14-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS compile-az
 COPY --from=build-az /opt/az /opt/az
 RUN python -W ignore -m compileall -q -j 0 --invalidation-mode unchecked-hash /opt/az/lib
 
 # Runtime: the same base, patched, with a non-root user and the tool on PATH.
-FROM docker.io/library/python:3.14-slim-trixie@sha256:caaf356f40667c496d405780745b9ac25771c189a51dfcc42430d531ea09f8a2 AS runtime
+FROM docker.io/library/python:3.14-slim-trixie@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS runtime
 # DEBIAN_UPGRADE=false where Debian's mirrors cannot be reached: the base image's own
 # packages are then the image's.
 ARG DEBIAN_UPGRADE