Locking julia dependencies

It would be nice to have an automatic way of locking Julia dependencies when releasing Python wheels, partly to minimize supply chain risks for users, and partly so that I can be confident there won't be bugs showing up. There are various tradeoffs, of course, but it might be nice to have a mechanism for this, similar to `uv.lock`.

No files or tests are named. Start by mapping how Python wheels are released and how Julia dependencies are currently represented, then compare the desired behavior with the referenced uv.lock approach; done means releases automatically produce a dependable dependency lock that addresses reproducibility and supply-chain concerns.

Vom Indexierungsmodell aus dem Issue-Text verfasst.