fix(studio): restore release lock contract

[zyn080302]

Summary

• restore the repository-root uv.lock as the Git-anchored Studio runtime lock
• fail fast with uv lock --check and run both Studio release workflow steps with uv run --frozen
• validate lock freshness inside the Release Server before frozen export, using canonical PyPI only for the check so deployment mirror settings cannot rewrite the lock
• add repository/workflow contract coverage and stale-lock/mirror-environment tests

Why

The Release Server builds from an exact Git SHA. The offline runtime already required uv.lock, but the file was ignored and absent from a fresh checkout, so the authenticated /release flow reached building and then failed before publication. The workflow's earlier uv run happened to generate an untracked lock in a different job, masking the missing source contract.

Tracking the synchronized lock is the smallest deterministic fix and preserves the existing full offline-bundle invariant. It avoids generating dependencies at release time and keeps future immutable runtime epochs anchored to reviewed Git content.

Verification

• uv lock --check
• 75 focused Release Server, Studio release, offline-runtime, and lock-contract tests
• Ruff
• Pyright (0 errors on changed Python files)
• workflow YAML parse and git diff --check
• full pre-commit, including gitleaks
• lock audit: canonical PyPI/files.pythonhosted.org sources only; no direct, credentialed, query, or fragment URLs