Daily dependency update fails: merging main into the update branch produces a uv.lock that uv cannot parse #889

The daily Update dependencies workflow (.github/workflows/update-dependencies.yml) has failed on every run since at least 2026-10-10.

What happens

Run 39659265166 fails at the "Generate API clients" step (./scripts/generate-clients.sh):

error: Failed to parse `uv.lock`
  cause: The entry for package `cryptography` (50.0.1) has wheel `cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl` with inconsistent version (49.0.0), which indicates a malformed wheel.

Cause

When an update PR is open (#583, branch update-dependencies, opened in June), .github/scripts/dependency-update-prepare-branch.sh checks out that branch and runs git merge --no-edit -X theirs origin/main. The run log shows git auto-merging all seven uv.lock files. A line-by-line merge of two generated lock files mixes entries from two different resolutions: here a cryptography 50.0.1 entry kept a 49.0.0 wheel list, and uv refuses the lock.

Fix

Build the update branch from origin/main on every run instead of merging main into the old branch, run the update, and replace the remote branch with --force-with-lease against the commit it pointed at when the run started. Skip the push when the branch already holds the same files. Keep reusing the open update PR and replace its description.