feat(ci): evaluate `uv sync --frozen` in the agent CI install path (align CI with prod image)

## Problem

The agent install task runs `uv sync --all-groups` **without `--frozen`** (`agent/mise.toml:13`), and CI's build invokes it via `mise run install` (`.github/workflows/build.yml`). Because it re-resolves rather than using the committed lock as-is, CI can diverge from the production image, which uses `uv sync --frozen` (`agent/Dockerfile:66`).

This divergence is what made #532's originally-approved fix (`exclude-newer = "7 days"`) break CI while leaving the image unaffected: the non-frozen install re-resolves and can become unsatisfiable, whereas `--frozen` would have used the lock unchanged.

## Proposed

Evaluate switching the CI install to `uv sync --frozen` (or `--locked`) so CI resolves exactly what the image ships, with lock drift caught explicitly rather than papered over by re-resolution.

## Governance note

This is a **CI/CD workflow change** — per ADR-009 it is High risk / 2P review and an implementor should not make it without explicit admin/2P sign-off. Filing for that track.

## Acceptance criteria

- Decision (with rationale) on frozen vs non-frozen CI install; if adopted, CI uses the committed lock and fails loudly on drift.

## Context

Maintainer-requested follow-up from #532.

Inizia da agent/mise.toml:13, .github/workflows/build.yml e agent/Dockerfile:66 per confrontare i percorsi di installazione di CI e produzione; esamina ADR-009 e il contesto di #532 prima di valutare il comportamento di frozen rispetto a locked. Conferma la decisione e la motivazione con il sign-off admin/2P richiesto, quindi verifica che CI utilizzi il lock committato e fallisca in caso di divergenze se la modifica viene adottata.

Scritto dal modello di indicizzazione a partire dal testo della issue.