feat(ci): evaluate `uv sync --frozen` in the agent CI install path (align CI with prod image)

## Problem

The agent install task runs `uv sync --all-groups` **without `--frozen`** (`agent/mise.toml:13`), and CI's build invokes it via `mise run install` (`.github/workflows/build.yml`). Because it re-resolves rather than using the committed lock as-is, CI can diverge from the production image, which uses `uv sync --frozen` (`agent/Dockerfile:66`).

This divergence is what made #532's originally-approved fix (`exclude-newer = "7 days"`) break CI while leaving the image unaffected: the non-frozen install re-resolves and can become unsatisfiable, whereas `--frozen` would have used the lock unchanged.

## Proposed

Evaluate switching the CI install to `uv sync --frozen` (or `--locked`) so CI resolves exactly what the image ships, with lock drift caught explicitly rather than papered over by re-resolution.

## Governance note

This is a **CI/CD workflow change** — per ADR-009 it is High risk / 2P review and an implementor should not make it without explicit admin/2P sign-off. Filing for that track.

## Acceptance criteria

- Decision (with rationale) on frozen vs non-frozen CI install; if adopted, CI uses the committed lock and fails loudly on drift.

## Context

Maintainer-requested follow-up from #532.

Beginne mit agent/mise.toml:13, .github/workflows/build.yml und agent/Dockerfile:66, um die Installationspfade von CI und Produktion zu vergleichen; prüfe ADR-009 und den Kontext in #532, bevor du das Verhalten von frozen gegenüber locked bewertest. Bestätige die Entscheidung und Begründung mit dem erforderlichen admin/2P sign-off und verifiziere anschließend, dass CI den committeten Lock verwendet und bei Abweichungen fehlschlägt, falls die Änderung übernommen wird.

Vom Indexierungsmodell aus dem Issue-Text verfasst.