Function provision

fn provision(app_root: &Path) -> Result<()>

Install the locked environment.

Normally this is a plain uv sync. Windows with Python 3.7 takes a different route; see provision_with_pip for why.