fix: use public dependency sources in lockfiles

Regenerate uv.lock against PyPI without changing dependency versions or hashes. Check Python and npm dependency sources before CI installation and enforce a current lockfile.

Fixes #28

.github/workflows/ci.yml

@@ -37,6 +37,9 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Check public dependency sources before installation
+        run: python scripts/check_dependency_sources.py
+
       - name: Set up uv
         uses: astral-sh/setup-uv@v6
         with:
@@ -44,7 +47,7 @@ jobs:
           cache-dependency-glob: uv.lock
 
       - name: Install locked development environment
-        run: uv sync --dev --frozen
+        run: uv sync --dev --locked
 
       - name: Check Python formatting
         run: uv run ruff format --check .