ci: align ci to ops version in uv.lock; add codespell; pin actions sha

[tromai]

Note

This PR is stacked on top of #142. Merging #142 will simplify the changes here.

Changes relevant to this PR starts from 0dfaec4

---

This PR made various improvements to the repo CI setup.

1. Add codespell

This tool is run in run_tests script. There is no error reported by the tool.

2. Updates how ops is imported in charm.py and test_charm.py

Use import ops then ops.Foo.Bar(...) instead of from ops.Foo import Bar. This is Charm Tech recommended style.

There is no runtime behaviour change.

3. Pin all action to commit hashes of latest version.

I also set the Juju channel to 4.1/stable as we discussed. We expect the CI to break until that channel is available.

4. Update ops version, and run CI with versions from uv.lock

We use different ops versions between packing and running unit tests:

• Packing the charm - use ops 3.3.1 (from uv.lock)
• Running unit tests. uv pip install ".[dev]" doesn't respect the locked version. Therefore it fetches the latest version since ops is not pinned in pyproject.toml.

We want it to be consistent.

Solution:

• Bumped ops version to ~=3.8 which is 3.8 or any newer 3.x version.
• Update uv.lock to use this ops version.
• Use uv sync --frozen --extra dev to prepare the virtual environment in respect to uv.lock (updates in ci.yaml, CONTRIBUTING.md, and AGENTS.md).