ci: pin dependencies to uv.lock for deterministic CI

[liana313]

Purpose

Make CI deterministic by pinning all dependencies to uv.lock. CI installed -e '.[dev]', which ignores uv.lock and resolves the newest versions every run — the root cause of recurring, code-unrelated flakiness:

• newer faiss-cpu/mypy surfaced type errors (fixed reactively in Fix mypy errors from dependency drift (unblock CI) #254)
• newer litellm (1.88.x) intermittently triggers OpenAI 431 "Request headers are too large" on large-payload calls (test_filter_cascade, test_sem_agg_document_long_context, multimodality) — a different test fails each run

Changes

• Add a "Generate locked constraints" step (uv export --locked --no-emit-project --no-hashes --all-extras -o /tmp/constraints.txt) and install with --constraint in both the lint and tests jobs. --locked also guards that uv.lock stays in sync with pyproject.toml.
• Regenerate uv.lock so it matches pyproject.toml again: gepa moves from the old git source to PyPI 0.1.1 (the lock went stale after Fix PyPI publish: use gepa from PyPI instead of git URL #256), and the project version syncs to 1.2.1. litellm stays pinned at the known-good 1.80.0 (below the 1.88.x that 431s). The large lockfile diff is mostly upload-time metadata added by the newer uv.

Test Plan / Results

Local, with the exact pinned set (litellm 1.80.0, mypy 1.18.2, faiss-cpu 1.13.0, ruff 0.14.5):

uv export --locked --no-emit-project --no-hashes --all-extras -o /tmp/constraints.txt   # passes (lock in sync)
uv pip install -e '.[dev]' --constraint /tmp/constraints.txt
ruff check lotus/      # All checks passed!
mypy lotus/            # Success: no issues found in 60 source files
python -c "import lotus"  # OK

The OpenAI 431 is server-side/transient; pinning to litellm 1.80.0 is the best in-repo mitigation. CI on this PR is the live confirmation.

Type of Change

• CI / build (non-breaking)