build: use UV_FROZEN not UV_LOCKED

[tlambert03]

@fdrgsp , I this will solve the uv.lock issues you're seeing in #19

according to https://docs.astral.sh/uv/concepts/projects/sync/#checking-if-the-lockfile-is-up-to-date:

To avoid updating the lockfile during uv sync and uv run invocations, use the --frozen flag.

To assert the lockfile matches the project metadata, use the --locked flag. If the lockfile is not up-to-date, an error will be raised instead of updating the lockfile.

all we really want to do is ensure that the lock file doesn't update while running tests. I don't think we need to assert that it wouldn't, since that might be a bit more specific to the uv version. I still don't have an answer as to why/when the lockfile is getting changed (when pyproject hasn't been touched).

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.18%. Comparing base (3627b8c) to head (5c05247).
Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #22      +/-   ##
==========================================
+ Coverage   83.33%   84.18%   +0.85%     
==========================================
  Files          15       16       +1     
  Lines         816      860      +44     
==========================================
+ Hits          680      724      +44     
  Misses        136      136              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.