fix(ci): use locked tooling for image verification

tests/release/test_image_contracts.py

@@ -73,6 +73,19 @@ exit "${scan_status}"'''
     )
 
 
+def test_repository_checks_use_the_locked_uv_environment():
+    steps = _workflow()["jobs"]["verify"]["steps"]
+    install = steps[_step_index(steps, "Install repository checks")]["run"]
+    lint = steps[_step_index(steps, "Run repository lint")]["run"]
+    tests = steps[_step_index(steps, "Run repository tests")]["run"]
+
+    assert 'python -m pip install "uv==0.11.14"' in install
+    assert "uv sync --extra dev --locked" in install
+    assert lint == "uv run ruff check ."
+    assert tests == "uv run pytest"
+    assert 'pip install ".[dev]"' not in install
+
+
 def test_tested_image_id_is_recorded_after_smoke_and_transferred_to_publish():
     workflow = _workflow()
     verify_steps = workflow["jobs"]["verify"]["steps"]