uv Git branch sources are still commit-pinned by uv.lock

Verified in a Python project using [tool.uv.sources] with git = "https://..." and branch = "main": resolved packages in uv.lock were pinned to explicit commit SHAs (...#<commit>), and installs followed those locked SHAs rather than the current branch head. This means branch-based sources do not automatically float to latest commits once locked.

When using uv with Git dependencies that specify a branch, treat uv.lock as the source of truth for the exact commit; run uv lock --upgrade-package <name> (or regenerate the lockfile) when you intentionally want newer commits from that branch.