ci: enforce uv.lock consistency with --locked flag

Add --locked flag to uv sync commands to fail if uv.lock is out of sync
with pyproject.toml. This ensures lockfile consistency across CI and
local development.

- Add --locked to setup-nix action
- Add --locked to flake.nix shellHook

Author: ryoppippi

.github/actions/setup-nix/action.yaml

@@ -43,7 +43,7 @@ runs:
     - name: Install Python dependencies
       if: inputs.skip-uv-sync != 'true'
       shell: bash
-      run: uv sync --all-extras
+      run: uv sync --all-extras --locked
 
     - name: Install MCP mock server dependencies
       if: inputs.skip-uv-sync != 'true' && inputs.skip-mock-server != 'true'

flake.nix

@@ -117,7 +117,7 @@
               # Install Python dependencies only if .venv is missing or uv.lock is newer
               if [ ! -d .venv ] || [ uv.lock -nt .venv ]; then
                 echo "📦 Installing Python dependencies..."
-                uv sync --all-extras
+                uv sync --all-extras --locked
               fi
 
               # Install git hooks