ci: include uv lock freshness in full validation

[codeforester]

Summary

Make the authoritative local validation aggregate verify that uv.lock is consistent with pyproject.toml. The baseline gate now requires uv and runs uv lock --check, keeping the documented local command aligned with CI's lockfile freshness job. The hosted quality job installs the same pinned uv tool before invoking the baseline gate.

Issue

Fixes #424

Validation

• bash -n tests/full_validate.sh
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache ./tests/full_validate.sh --gate baseline
• git diff --check
• Hosted quality validation is running against the current head after the main refresh.

Train

This is the implementation car for the open v0.5.0 validation issue. Release publication remains a later, separately reviewed step.

[codeforester]

Reviewed head c640617 against #424. The change is right: run_baseline now fails clearly when uv is missing (require_commands uv) and runs uv lock --check, and the quality job installs the pinned uv so CI keeps running the same gate. CI is green. One merge-order problem (please rebase before merging):

The branch predates #423, which merged at 17:06 and cut ## [0.5.0] - 2026-10-03 out of [Unreleased]. Git merges this cleanly, but against current main the new changelog line lands inside the 0.5.0 release section, at the top of its ### Changed list, while [Unreleased] stays empty apart from ### Planned. I checked with git merge-tree origin/main <this head>:

## [Unreleased]
### Planned
...
## [0.5.0] - 2026-10-03
### Changed
- Include `uv.lock` freshness in the authoritative local validation aggregate (#424).   <-- lands here
- Bound convenience-profile discovery ... (#385).

Please rebase onto main and move the entry under [Unreleased] → ### Changed, unless #424 is meant to ship in 0.5.0. In that case it also belongs in docs/release-0.5.0-checklist.md. #430 is stacked on this branch and will inherit the fix.

[codeforester]

Follow-up on the review findings:

• Rebased the branch onto current main (2acd6367).
• Moved the uv.lock freshness entry from the released 0.5.0 section back under [Unreleased].
• tests/full_validate.sh --gate baseline, shell syntax, and diff checks pass locally.

The PR head is now 972b6358.

[codeforester]

Re-verified at 972b635: fixed ✅. Rebased onto 2acd636 (#423). git merge-tree against current main now puts the uv.lock freshness entry under ## [Unreleased] → ### Changed, and [0.5.0] is untouched. CI is green (95/95). Ready to merge.