fix: fail early when pyproject changes without uv lock

[jr200]

Summary

• add an early PR guard to Python CI for repos with uv.lock
• fail when root pyproject.toml changes without a matching root uv.lock change
• keep the existing uv lock freshness check for actual lock validation

Context

PR whengas/whengas-api#82 changed pyproject.toml without uv.lock. Existing CI catches the stale lock via uv lock --check, but only during dependency install. This makes the file invariant explicit and fails before Python/dependency setup.

Validation

• git diff --check
• bash -n scripts/test-shared-sync.sh
• actionlint .github/workflows/ci_uv_python.yaml
• local bash simulation against whengas/whengas-api PR 82 diff returned would_fail

[jr200]

Closing this direction. The desired fix is for Renovate to regenerate uv.lock on dependency PRs; this PR only added an early CI guard/backstop and does not address the automation failure.