chore(ci): enforce uv.lock is in sync (#3679)

Add a uv lock --check guard in two places so a stale uv.lock cannot be
committed unnoticed (as happened with the groundroute extra):

- pre-commit: a local uv-lock-check hook, scoped to the backend
  pyproject.toml files and uv.lock.
- CI: a "Check uv.lock is in sync" step in the lint-backend job, run
  before uv sync so the install step cannot mask a stale lock by
  regenerating it.

.github/workflows/lint-check.yml

@@ -23,6 +23,10 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v7
 
+      - name: Check uv.lock is in sync
+        working-directory: backend
+        run: uv lock --check
+
       - name: Install dependencies
         working-directory: backend
         run: |

.pre-commit-config.yaml

@@ -14,6 +14,12 @@ repos:
         language: system
         types_or: [python]
         files: ^backend/
+      - id: uv-lock-check
+        name: uv lock check
+        entry: bash -c 'cd backend && uv lock --check'
+        language: system
+        pass_filenames: false
+        files: ^backend/(pyproject\.toml|uv\.lock|packages/harness/pyproject\.toml)$
 
   # Frontend: eslint + prettier (must run from frontend/ for node_modules resolution)
   - repo: local