[echarles]

Environment builds pin uv 0.12.11 into the image, and the artifact scan now blocks it: GHSA-hq85-5cpj-mr62 (CRITICAL), fixed in 0.13.4. Found on a real build, which failed with DL_ENV_SCAN_BLOCKED. Every pin moves to 0.13.6, the current release. The fixtures that quote what uv wrote carry the same output; CI is what confirms the resolver's parsing still holds.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the uv pin and package-version updates.

No open issues 🎉

What changed in this PR

Updates environment-building paths to pin uv 0.13.6, addressing the reported security scan blocker, and bumps the package version to 1.11.2.

Changes:

• Upgrades uv pins across the resolver and Datalayer, E2B, and Modal adapters.
• Updates bootstrap test expectations and the resolver fixture-version comment; recorded output remains unchanged.
• Bumps the package patch version.

File	Description
tests/​test_environment_resolve.py	Updates uv assertions and the recorded-output version comment.
tests/​test_environment_datalayer_builder.py	Updates expected uv bootstrap version.
code_sandboxes/​environments/​resolve.py	Pins resolver bootstrap to uv 0.13.6.
code_sandboxes/​environments/​adapters/​modal.py	Updates the Modal uv pin.
code_sandboxes/​environments/​adapters/​e2b.py	Updates the E2B uv pin.
code_sandboxes/​environments/​adapters/​datalayer.py	Updates the Datalayer bootstrap uv pin.
code_sandboxes/​__version__.py	Bumps the package version to 1.11.2.

_{Review effort: Balanced}