Bring `make check` closer to the hosted CI workflow (locked install, Python matrix)

Follow-up from the review of #74 (finding R1-F3, non-blocking).

Problem

Makefile comments check as "Everything the hosted CI workflow runs", and until #74 the instruction files and README repeated that. It is only true of the commands: tests/test_ci_workflow.py::test_ci_runs_the_same_commands_as_the_local_make_targets pins that every command in make test / lint / fmt-check / typecheck also appears in .github/workflows/ci.yml. CI does two more things make check does not:

• installs from the lockfile with uv sync --locked, so a stale uv.lock fails CI but passes locally;
• runs pytest on Python 3.11 and 3.12, while make check runs on whatever interpreter the local environment resolves (the repo's .python-version is currently 3.14, which is not in the CI matrix at all).

#74 corrects the prose in AGENTS.md, tests/AGENTS.md and README "Development" to describe what make check actually covers. This issue is about narrowing the gap itself, which was out of scope for an instruction-only refactor.

Proposal

1. Add a lockfile check to check (for example a lock-check target running uv lock --check, which is what --locked enforces in CI) so a stale lock is caught before pushing.
2. Fix the Makefile comment on check to match: same commands as CI, single local interpreter.
3. Optionally add a check-matrix (name open) target that runs pytest on every CI Python (uv run --python 3.11 pytest, uv run --python 3.12 pytest), reading the versions from one place if the drift guard can pin it, so the matrix is not maintained twice.
4. Extend tests/test_ci_workflow.py if a new mirrored target is introduced, so CI and the Makefile keep matching in both directions.

Non-goals

• Changing what CI runs.
• Making make check slower by default; the matrix target should be opt-in.

Working copy of this note: none, the issue is the artifact.

Start with the check target in Makefile, then compare its commands with .github/workflows/ci.yml and the version assumptions in .python-version. Read tests/test_ci_workflow.py, especially its command-matching test, before deciding how any new target should be represented. Done means stale locks are detected, the comment matches behavior, and any added matrix target is covered by the drift checks.