ci: verify uv.lock is current before sync

Adds `uv lock --check` ahead of `make sync`. Now that uv.lock is tracked, a
PR that edits pyproject.toml without re-locking would otherwise pass CI —
`make sync` (uv sync, no --locked) silently re-resolves in the throwaway
checkout, discarding the update and leaving the committed lock stale. The
read-only check fails fast instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: andre-salvati

.github/workflows/onpush.yml

@@ -46,6 +46,12 @@ jobs:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
+      # Fail if a PR edited pyproject.toml without re-running `uv lock`. `make sync`
+      # would silently re-resolve and discard the update in CI's throwaway checkout,
+      # leaving the committed uv.lock stale. This read-only check keeps them in sync.
+      - name: Verify lockfile is current
+        run: uv lock --check
+
       - name: Install dependencies
         run: make sync