ci(deps): use QPK pin script and enforce uv lock check (#319)

Call canonical check_qpk_pin_consistency from checked-out QPK and fail CI
when uv.lock drifts from pyproject/override pins.

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

.github/workflows/ci.yml

@@ -111,7 +111,14 @@ jobs:
           uv run --no-sync ruff check --exclude external .
 
       - name: Check QPK pin consistency
-        run: uv run --no-sync python scripts/check_qpk_pin_consistency.py
+        run: |
+          set -euo pipefail
+          uv run --no-sync python external/QuantPlatformKit/scripts/check_qpk_pin_consistency.py \
+            --root . \
+            --pin-file external/QuantPlatformKit/QPK_PIN
+
+      - name: Ensure uv.lock matches pyproject.toml
+        run: uv lock --check
 
       - name: Run unit tests
         run: |