fix(py): rebuild the bindings when their version or Rust changes

[dekobon]

make worktree-setup runs uv sync, and on a clean main it replaced a
current 2.2.1 install of the Python bindings with a cached 2.1.1 build.

Cause

The bindings' version is dynamic: maturin reads it from the crate's
Cargo.toml, which inherits it from the workspace root
(version.workspace = true). The extension also compiles the root and ast
crates, one directory up. uv's default cache key watches only
pyproject.toml / setup.* inside the project directory, so neither a
version bump nor a Rust change ever invalidated its cached build.

Fix

[tool.uv].cache-keys in big-code-analysis-py/pyproject.toml now lists
what the build actually reads: the manifests, the root Cargo.lock, and
the Rust sources. It follows the template uv init --build-backend maturin
generates, pointed at this workspace member's parent directory. Setting the
key replaces uv's default, so pyproject.toml is listed again.

The comment beside dynamic = ["version"] pointed at a
[tool.maturin].version key that doesn't exist; it now says where the
version really comes from.

Verified

Check	Result
uv sync on main (reproduction)	2.2.1 → 2.1.1
uv sync with the fix	rebuilt → 2.2.1
second sync, nothing changed	no-op, 0 s — no rebuild on every run
touch ../src/lib.rs	rebuilt (Built big-code-analysis, extension mtime advanced)
touch ../big-code-analysis-ast/src/lib.rs	rebuilt
same touch with the fix stashed	no rebuild — the keys are the cause
uv lock --check	unchanged; --locked still holds
make pre-commit	BCA_GATE: pass

Impact

Contributor environment only; nothing shipped changes. The effect was
smaller than "stale code": the compiled extension that happened to be in
the source tree was current, and only the installed package metadata
reported 2.1.1. make pre-commit and CI were never affected, because
py-test rebuilds with maturin develop before testing. But a venv synced
by worktree-setup could not be trusted to match the tree, and a Rust-only
change would never have been rebuilt by uv at all.

Not covered: the vendored tree-sitter-* grammar crates. A grammar
regeneration changes C sources those crates compile, which these keys do
not watch; uv sync --reinstall-package big-code-analysis rebuilds when
that matters.