ci: add regression gates for handoff and dependencies

[jmservera]

Summary

• add a cache-independent requirements.lock drift gate and install CI dependencies from the lockfile
• add a shared SquadScope -> Podcaster handoff contract fixture and local fixture-shape regression test
• leave CodeQL to the repository managed/default setup; recommend making its existing Analyze checks required instead of adding a conflicting checked-in workflow

Validation

• python3 -m pytest -q tests/test_podcaster_handoff.py
• uv pip compile requirements.txt --python-version 3.12 --no-header --no-cache -o requirements.lock.check && diff -u requirements.lock requirements.lock.check

Closes part of jmservera/SquadScope-Coordinator#38.

Required checks are repository settings, not changed here. Recommended required contexts for main: Python, Lockfile, Publish hydration parity, Production site build, Production site (Axe and responsive browser gates), Production site (Lighthouse gates), Production site (Visual structure gate), Ruff, Checkov IaC/container scan, Bandit Python security scan, GitHub Actions Security Scan (zizmor), managed CodeQL Analyze (actions/javascript-typescript/python).

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.