build: install CI dependencies from a lockfile

[leiverkus]

Closes the drift class that produced the last two CI failures. No source changes.

Why

CI resolved dependencies fresh on every run, so an unchanged tree could go red whenever a transitive dependency published. That happened twice this week:

• ruff 0.16.0 enabled RUF100 by default → 65 errors in files untouched since June (fix: pin ruff and select the lint rule set explicitly #6).
• numpy 2.5 shipped PEP 695 stubs that mypy's pinned 3.11 target could not parse → the 3.12 job failed (fix: pin ruff and select the lint rule set explicitly #6, second commit).

Both were fixed at the symptom. Neither fix prevents the next one: numpy>=1.26, mypy>=1.10, pytest>=8 and the whole geo stack are still open-ended.

What changed

CI installs from uv.lock via uv sync --locked --extra dev --extra geo instead of resolving.

The lock is universal, which this project specifically needs. numpy resolves to 2.4.6 on 3.11 and 2.5.1 on 3.12 — that is the exact split that caused the mypy failure. A flat pinned requirements.txt cannot express it in one artefact; uv.lock records both behind resolution markers, so one file covers the matrix.

--locked is the guard. It fails when the lock is stale with respect to pyproject.toml, so a dependency edit cannot land without a refreshed lock in the same commit. Verified by narrowing the numpy constraint without re-locking:

error: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided.

uv (0.11.32) and setup-uv (v9) are pinned exactly, on the same reasoning as the existing ruff==0.16.0 pin. setup-uv v9 runs on the node24 runtime.

Local development is untouched. pip install -e ".[dev]" still works and stays unlocked — convenient day to day, with CI as the authority on versions. docs/development.md gains a Dependency locking section covering the split, uv lock --upgrade, and the hint to compare versions when something reproduces in CI but not locally.

Verification

Run with the workflow's own commands (uv sync --locked → uv run --no-sync) on both matrix versions:

	3.11	3.12
ruff check .	pass	pass
mypy src	26 files clean	26 files clean
pytest -q	57 passed, 2 skipped	57 passed, 2 skipped

Confirmed the locked resolution is what actually lands: on 3.12 the synced env reports numpy 2.5.1 and ruff 0.16.0.

Note

ruff==0.16.0 stays pinned in pyproject.toml even though the lock now pins it too. It is not redundant: it keeps the unlocked pip install -e ".[dev]" path on the same linter as CI, which is the case where a version mismatch is most confusing.

🤖 Generated with Claude Code