Decide when/where to use --frozen and --locked #316
Description
In the PR #315 we experienced an interesing edge case. We previously bump the tag, thus the version, without touching pyproject.toml. Therefore, --locked couldn't identify any change, and consider the outdated version (pip --editable) just fine. Together the GA cache with --locked would satisfy the requirements and run an old version so we woul be completely blind on errors caused by the current PR, i.e. tests would run an old version and succeed.
It's not clear the best option here, because we do want to prevent updating pyproject.toml without updating pixi.lock, so the --locked help with that, but what is the most convenient solution to still use cache but also track if we are indeed testing the latest version?
One thought is to run tests without --locked or --freeze, but add one new step in the publish workflow to verify that pixi.lock is sync and validate with git tags ....