Consider to store uv.lock in repository

[okurz]

Originally posted by @mpagot in #319 (comment)

For applications, uv.lock should be committed to version control for reproducible, cross-platform environments.
The official layout guide recommends this: https://docs.astral.sh/uv/concepts/projects/layout/#the-lockfile
uv automatically manages uv.lock; uv sync uses it to create identical environments for all users.
This behavior is detailed at: https://docs.astral.sh/uv/concepts/projects/sync/
For libraries, committing uv.lock is also the recommended practice for development consistency.
This provides a stable, reproducible environment for all contributors and for your primary CI tests.
To ensure broad compatibility, your CI should also test against different dependency resolutions.
Use uv sync --resolution lowest in CI to verify your declared lower dependency bounds.
Use uv sync --upgrade in a separate CI job to test against the latest compatible versions.
These settings are explained at: https://docs.astral.sh/uv/reference/settings/#resolution