feat(ci): evaluate `uv sync --frozen` in the agent CI install path (align CI with prod image)

## Problem

The agent install task runs `uv sync --all-groups` **without `--frozen`** (`agent/mise.toml:13`), and CI's build invokes it via `mise run install` (`.github/workflows/build.yml`). Because it re-resolves rather than using the committed lock as-is, CI can diverge from the production image, which uses `uv sync --frozen` (`agent/Dockerfile:66`).

This divergence is what made #532's originally-approved fix (`exclude-newer = "7 days"`) break CI while leaving the image unaffected: the non-frozen install re-resolves and can become unsatisfiable, whereas `--frozen` would have used the lock unchanged.

## Proposed

Evaluate switching the CI install to `uv sync --frozen` (or `--locked`) so CI resolves exactly what the image ships, with lock drift caught explicitly rather than papered over by re-resolution.

## Governance note

This is a **CI/CD workflow change** — per ADR-009 it is High risk / 2P review and an implementor should not make it without explicit admin/2P sign-off. Filing for that track.

## Acceptance criteria

- Decision (with rationale) on frozen vs non-frozen CI install; if adopted, CI uses the committed lock and fails loudly on drift.

## Context

Maintainer-requested follow-up from #532.

Start with agent/mise.toml:13, .github/workflows/build.yml, and agent/Dockerfile:66 to compare the CI and production install paths; review ADR-009 and the context in #532 before evaluating frozen versus locked behavior. Confirm the decision and rationale with the required admin/2P sign-off, then verify that CI uses the committed lock and fails on drift if the change is adopted.

Written by the indexing model from the issue text.