[SKY-8441] Remove python-ecdsa from integration lock files

[AronPerez]

Summary

• Add [tool.uv.sources] to integrations/llama_index/ and integrations/langchain/ to resolve skyvern from local workspace instead of PyPI
• Regenerate lock files, removing python-ecdsa and python-jose from the dependency tree
• Completes the Minerva CVE remediation started in [SKY-8441] Address Minerva timing attack on P-256 in python-ecdsa #5184

Context

PR #5184 replaced python-jose with PyJWT in the main project, but the integration lock files still resolved skyvern==1.0.24 from PyPI (which still declares python-jose). This change points the integrations at the local source so the lock files pick up the fix.

Test Plan

• grep -r "ecdsa" integrations/ returns no results
• grep -r "python-jose" integrations/ returns no results
• uv lock resolves successfully for both integrations

[AronPerez]

Resolve skyvern from the local workspace so the lock file picks up the python-jose → PyJWT migration instead of the stale PyPI metadata

[Copilot]

Pull request overview

This PR updates the LangChain and LlamaIndex integration environments to resolve skyvern from the local workspace (instead of PyPI) so their lockfiles pick up the previously-remediated JWT dependency change and drop the python-jose → ecdsa chain.

Changes:

• Add [tool.uv.sources] entries so integrations resolve skyvern from ../.. (repo root).
• Regenerate uv.lock files to remove python-jose / ecdsa (and related packages like rsa) from the dependency graph.
• Update locked skyvern source in the integration lockfiles to a local directory reference.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
integrations/llama_index/pyproject.toml	Points skyvern dependency resolution at the local repo via [tool.uv.sources].
integrations/llama_index/uv.lock	Re-locks dependencies using local skyvern, removing python-jose/ecdsa and updating the resolved tree.
integrations/langchain/pyproject.toml	Points skyvern dependency resolution at the local repo via [tool.uv.sources].
integrations/langchain/uv.lock	Re-locks dependencies using local skyvern, removing python-jose/ecdsa and updating the resolved tree.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.