feat(ci): evaluate `uv sync --frozen` in the agent CI install path (align CI with prod image)

## Problem

The agent install task runs `uv sync --all-groups` **without `--frozen`** (`agent/mise.toml:13`), and CI's build invokes it via `mise run install` (`.github/workflows/build.yml`). Because it re-resolves rather than using the committed lock as-is, CI can diverge from the production image, which uses `uv sync --frozen` (`agent/Dockerfile:66`).

This divergence is what made #532's originally-approved fix (`exclude-newer = "7 days"`) break CI while leaving the image unaffected: the non-frozen install re-resolves and can become unsatisfiable, whereas `--frozen` would have used the lock unchanged.

## Proposed

Evaluate switching the CI install to `uv sync --frozen` (or `--locked`) so CI resolves exactly what the image ships, with lock drift caught explicitly rather than papered over by re-resolution.

## Governance note

This is a **CI/CD workflow change** — per ADR-009 it is High risk / 2P review and an implementor should not make it without explicit admin/2P sign-off. Filing for that track.

## Acceptance criteria

- Decision (with rationale) on frozen vs non-frozen CI install; if adopted, CI uses the committed lock and fails loudly on drift.

## Context

Maintainer-requested follow-up from #532.

Empieza por agent/mise.toml:13, .github/workflows/build.yml y agent/Dockerfile:66 para comparar las rutas de instalación de CI y producción; revisa ADR-009 y el contexto de #532 antes de evaluar el comportamiento de frozen frente a locked. Confirma la decisión y la justificación con el admin/2P sign-off requerido y, después, verifica que CI use el lock commiteado y falle si hay divergencias en caso de que se adopte el cambio.

Escrito por el modelo de indexación a partir del texto del issue.