feat(ci): evaluate `uv sync --frozen` in the agent CI install path (align CI with prod image)

Problem

The agent install task runs uv sync --all-groups without --frozen (agent/mise.toml:13), and CI's build invokes it via mise run install (.github/workflows/build.yml). Because it re-resolves rather than using the committed lock as-is, CI can diverge from the production image, which uses uv sync --frozen (agent/Dockerfile:66).

This divergence is what made #532's originally-approved fix (exclude-newer = "7 days") break CI while leaving the image unaffected: the non-frozen install re-resolves and can become unsatisfiable, whereas --frozen would have used the lock unchanged.

Proposed

Evaluate switching the CI install to uv sync --frozen (or --locked) so CI resolves exactly what the image ships, with lock drift caught explicitly rather than papered over by re-resolution.

Governance note

This is a CI/CD workflow change — per ADR-009 it is High risk / 2P review and an implementor should not make it without explicit admin/2P sign-off. Filing for that track.

Acceptance criteria

• Decision (with rationale) on frozen vs non-frozen CI install; if adopted, CI uses the committed lock and fails loudly on drift.

Context

Maintainer-requested follow-up from #532.

agent/mise.toml:13、.github/workflows/build.yml、agent/Dockerfile:66 から始めて、CI と本番のインストールパスを比較してください。frozen と locked のどちらの挙動を評価するかを決める前に、ADR-009 と #532 のコンテキストを確認してください。必要な admin/2P sign-off を得て決定とその根拠を確認し、変更を採用する場合は、CI がコミット済みの lock を使用し、差分があると失敗することを検証してください。