Regenerate Harbor uv.lock files against public PyPI #2226

🤖 Reported by Codex during the public-release documentation audit.

Summary

The Harbor benchmark lockfiles contain package sources and artifact URLs for Block's internal Artifactory mirror instead of public PyPI:

• benchmarks/harbor-buzz-orchestra/uv.lock: 1,589 references to global.block-artifacts.com
• benchmarks/harbor-buzz-orchestra/testbed/uv.lock: 1,645 references to global.block-artifacts.com

Neither adjacent pyproject.toml explicitly configures that index, so the lockfiles appear to have captured a developer-global uv configuration when they were generated.

Impact

External contributors may be unable to run uv sync --frozen for these benchmark environments without access to Block's package mirror. The committed files also expose an organization-specific dependency endpoint that is not part of the open-source setup.

Suggested fix

1. Regenerate both lockfiles in a clean environment with public PyPI explicitly selected, for example with https://pypi.org/simple as the default index.
2. Run uv sync --frozen for both projects from an environment without Block credentials or package-index configuration.
3. Consider adding a CI check that rejects organization-only package hosts in committed lockfiles.

Acceptance criteria

• Neither lockfile contains global.block-artifacts.com or another private package host.
• Both benchmark environments install successfully with uv sync --frozen using public dependencies only.
• Existing benchmark tests still pass.