fix(ci): isolate downstream dependency resolver

[Pigbibi]

Summary

• create a temporary uv virtual environment for each downstream dependency dry-run
• avoid relying on an ambient virtual environment on GitHub-hosted runners

This fixes the first staged propagation run, which correctly reached dependency verification but failed because uv pip had no target environment.

Verification

• CN strategy staged dry-run passed
• 14 targeted tests passed
• Ruff/actionlint/diff check passed

No live, trading, Binance, or OCI changes.