Decide when/where to use `--frozen` and `--locked`

In the PR #315 we experienced an interesing edge case. We previously bump the tag, thus the version, without touching pyproject.toml. Therefore, --locked couldn't identify any change, and consider the outdated version (pip --editable) just fine. Together the GA cache with --locked would satisfy the requirements and run an old version so we woul be completely blind on errors caused by the current PR, i.e. tests would run an old version and succeed.

It's not clear the best option here, because we do want to prevent updating pyproject.toml without updating pixi.lock, so the --locked help with that, but what is the most convenient solution to still use cache but also track if we are indeed testing the latest version?

One thought is to run tests without --locked or --freeze, but add one new step in the publish workflow to verify that pixi.lock is sync and validate with git tags ....

Review PR #315 and the workflows using the GA cache, --locked, and --freeze; inspect pyproject.toml and pixi.lock to understand the version-checking edge case. Done means an agreed workflow that does not test an outdated editable version while retaining lock-file validation, including any publish-workflow check against git tags.