ci(deps): use QPK pin script and enforce uv lock check

.github/workflows/ci.yml

@@ -91,11 +91,18 @@ jobs:
           set -euo pipefail
           uv run --no-sync ruff check --exclude external .
 
+      - name: Check QPK pin consistency
+        run: |
+          set -euo pipefail
+          uv run --no-sync python external/QuantPlatformKit/scripts/check_qpk_pin_consistency.py \
+            --root . \
+            --pin-file external/QuantPlatformKit/QPK_PIN
+
+      - name: Ensure uv.lock matches pyproject.toml
+        run: uv lock --check
+
       - name: Run tests
         run: uv run --no-sync python -m pytest -q
 
-      - name: Check QPK pin consistency
-        run: uv run --no-sync python scripts/check_qpk_pin_consistency.py
-
       - name: Build package
         run: uv run --no-sync python -m build

tests/test_dependency_pin_guard.py

@@ -61,5 +61,6 @@ def test_dependency_pin_guard_is_blocking_in_ci() -> None:
     next_step = workflow.find("\n      - name:", step_start + 1)
     step = workflow[step_start : next_step if next_step != -1 else len(workflow)]
 
-    assert "uv run --no-sync python scripts/check_qpk_pin_consistency.py" in step
+    assert "external/QuantPlatformKit/scripts/check_qpk_pin_consistency.py" in step
+    assert "--pin-file external/QuantPlatformKit/QPK_PIN" in step
     assert "continue-on-error" not in step

tests/test_uv_dependency_workflow.py

@@ -21,7 +21,8 @@ def test_ci_docker_and_env_sync_use_uv_lock() -> None:
     assert "uv sync --frozen --extra test" in ci
     assert "uv pip check" in ci
     assert "uv run --no-sync ruff check --exclude external ." in ci
-    assert "uv run --no-sync python scripts/check_qpk_pin_consistency.py" in ci
+    assert "external/QuantPlatformKit/scripts/check_qpk_pin_consistency.py" in ci
+    assert "uv lock --check" in ci
     assert "uv run --no-sync python -m build" in ci
     assert "uv sync --frozen --no-dev" in env_sync
     assert "uv run --no-sync python scripts/build_cloud_run_env_sync_plan.py --json" in env_sync