[cassiofariasmachado]

Description

Adds a guardrail that fails whenever uv.lock is out of date with pyproject.toml, closing a lockfile-drift gap.

Recently a batch dependabot bump (#415) changed pyproject.toml without updating uv.lock. Nothing in CI caught it: the checks.yaml job runs uv sync --all-extras, which silently regenerates the lock in the runner instead of failing on stale state. Because dependabot patch/minor PRs auto-merge, a drifted lock can reach main with no human in the loop.

This PR adds the check in two places:

• CI (.github/workflows/checks.yaml): a uv lock --check step placed before uv sync, so sync cannot mask the drift. Runs on every PR and push to main, and since dependabot PRs also trigger this workflow, it covers the auto-merge path.
• Pre-commit (.pre-commit-config.yaml): a uv-lock-check local hook scoped via files: to pyproject.toml / uv.lock changes, giving contributors fast local feedback without slowing down ordinary code commits.

Type of Change

• Code refactoring
• Dependency update

How to Test

1. On a branch, edit a dependency bound in pyproject.toml but do not re-lock.
2. Run uv lock --check locally (or push and watch the "Verify uv.lock is up to date" CI step), it should fail.
3. Run uv lock, commit the updated uv.lock, and confirm both the local check and CI step pass.

Pre-commit hook scoping can be verified directly with uvx pre-commit run uv-lock-check --all-files (passes), and it is skipped on commits that touch neither pyproject.toml nor uv.lock.

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Additional Notes

The drift from #415 was already reconciled on main, so uv lock --check passes on the current tip. This PR only installs the guardrail; no lockfile reconcile commit is included.