CI re-resolves uv.lock instead of installing it as committed #677

uv sync --all-extras --dev in CI runs without --locked (or --frozen):

• .github/workflows/python-package.yml:37
• .github/workflows/release.yml:30

So every CI run (including the release build) is free to re-resolve dependencies instead of installing exactly what uv.lock pins. A stale or inconsistent lock never fails CI, and a release can be tested against versions different from the committed lock. .readthedocs.yaml:19 already uses --frozen.

Found while preparing #676: locally the upgrade was resolved with a 7-day exclude-newer cooldown that lives only in a global uv config, not in the project. CI ignores it and re-resolves; the versions happened to come out identical this time, but nothing guarantees it.

Proposed fix

• Use uv sync --locked --all-extras --dev in both workflows (fails if uv.lock is out of date with pyproject.toml), and keep uv run from re-locking (UV_LOCKED=1 or --locked).
• Optionally move the exclude-newer cooldown into [tool.uv] in pyproject.toml, so local upgrades and CI share the same resolution policy.

Acceptance: CI fails on a PR whose uv.lock does not match pyproject.toml, and passes otherwise.