Register and check rules for using, installing, testing and relocking from uv.lock #3996

Problem

The Cloud Run image installs exactly the versions in uv.lock (uv sync --frozen), but nothing checks that the rest of the repository does the same. A workflow step, script, Makefile target or Dockerfile can still install with pip or an unfrozen uv run, and tests can run against versions production does not run. Nothing checks that uv.lock matches pyproject.toml in pull request CI, or that a scheduled relock exists.

Proposal

Register four mechanically checked rules in rules/registry.toml:

1. We use uv.lock: every project directory has a committed uv.lock, and pull request CI runs uv lock --check.
2. We install from uv.lock: every install in workflows, the scripts they run, Makefiles, Dockerfiles and Modal image definitions uses uv sync --frozen / uv run --frozen.
3. We test from uv.lock: every test command in CI runs through uv run --frozen.
4. We relock on a schedule: a scheduled workflow relocks every uv.lock with upgrades and opens or updates a pull request.

An install that cannot use the lock yet is a registered exception that names one site, gives a reason, and has a removal condition, or a review date with a tracking issue. A command-line tool pinned with == outside the project may be registered as a pinned-tool.

Builds on #3995 (tests install from uv.lock) and #3994 (daily relock workflow).