ci: allow resolver job to commit uv lock

.github/workflows/refresh-uv-lock.yml

@@ -6,13 +6,15 @@ on:
       - main
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.head_ref }}
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13.15"
@@ -20,6 +22,17 @@ jobs:
         run: python -m pip install --disable-pip-version-check uv
       - name: Regenerate lockfile
         run: uv lock
+      - name: Commit refreshed lockfile
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add uv.lock
+          if git diff --cached --quiet; then
+            echo "uv.lock already up to date"
+          else
+            git commit -m "build(deps): regenerate uv lock"
+            git push origin HEAD:${{ github.head_ref }}
+          fi
       - name: Upload lockfile
         uses: actions/upload-artifact@v7
         with: