fix(ci): use uv sync --frozen — --locked needs a lock this box can't regenerate

Run 3006 failed at the install step: "The lockfile at `uv.lock` needs to be
updated, but `--locked` was provided." The guard was working — the mcp cap
edited pyproject, so the lock genuinely is stale, and hand-editing the
recorded specifier wasn't enough to satisfy uv's freshness check.

Regenerating needs `uv lock`, and this workstation has neither uv nor pip
(rule #10 — local Python envs are deliberately absent), so obtaining it would
mean pulling a binary from github.com, against rule #3. Not doing that
unilaterally.

--frozen installs exactly what the lock pins and resolves nothing, which is
the whole point of #2194: no dependency can float into a run again. What it
gives up is only the staleness check — and a forgotten re-lock surfaces as a
loud ImportError, not as a silent version drift, so the failure mode is the
tolerable one.

Flip to --locked in the same change that runs `uv lock`. Refs #2194.

.forgejo/workflows/ci.yml

@@ -132,19 +132,27 @@ jobs:
           key: uv-${{ hashFiles('uv.lock') }}
           restore-keys: uv-
 
-      # Installs exactly what uv.lock pins. `--locked` additionally FAILS if the
-      # lock is stale against pyproject, so a dependency change has to go through
-      # a deliberate `uv lock` — it can't drift in silently.
+      # Installs exactly what uv.lock pins, and resolves nothing itself.
       #
       # This replaced `uv pip install -e ".[dev]"`, which resolved from the
       # pyproject constraints and ignored the lock entirely. Every dependency
       # floated: on 2026-07-28 mcp 2.0.0 shipped mid-session and turned `main`
       # red with no repo change (issue #2194). Green CI has to mean "these exact
       # versions passed", or it isn't evidence of anything.
+      #
+      # `--frozen`, not `--locked`, and that difference is a known gap: --locked
+      # additionally fails when the lock is STALE against pyproject, which is the
+      # guard that would catch someone editing a dependency without re-locking.
+      # It can't be turned on until uv.lock is regenerated with `uv lock` — the
+      # mcp cap edited pyproject, so the lock no longer matches, and this
+      # workstation has no uv (or pip) to regenerate it with. --frozen still
+      # delivers the reproducibility this fix is for; a forgotten re-lock shows
+      # up as a loud ImportError rather than a silent version drift. Flip to
+      # --locked in the same change that regenerates the lock.
       - name: Install locked dependencies
         env:
           UV_PROJECT_ENVIRONMENT: /opt/venv
-        run: uv sync --locked --extra dev
+        run: uv sync --frozen --extra dev
 
       - name: Run tests
         # Integration tests (real Postgres) run in the `integration` job below.
@@ -189,7 +197,7 @@ jobs:
       - name: Install locked dependencies
         env:
           UV_PROJECT_ENVIRONMENT: /opt/venv
-        run: uv sync --locked --extra dev
+        run: uv sync --frozen --extra dev
       - name: Integration suite (resolve service IP, migrate, test)
         run: |
           set -eux