ci: pin dependencies to uv.lock for deterministic CI (#259)

## Purpose

Make CI deterministic by pinning all dependencies to `uv.lock`. CI
installed `-e '.[dev]'`, which **ignores `uv.lock` and resolves the
newest versions every run** — the root cause of recurring,
code-unrelated flakiness:

- newer `faiss-cpu`/`mypy` surfaced type errors (fixed reactively in
#254)
- newer `litellm` (1.88.x) intermittently triggers OpenAI **431 "Request
headers are too large"** on large-payload calls (`test_filter_cascade`,
`test_sem_agg_document_long_context`, multimodality) — a different test
fails each run

## Changes

- Add a **"Generate locked constraints"** step (`uv export --locked
--no-emit-project --no-hashes --all-extras -o /tmp/constraints.txt`) and
install with `--constraint` in **both** the lint and tests jobs.
`--locked` also guards that `uv.lock` stays in sync with
`pyproject.toml`.
- **Regenerate `uv.lock`** so it matches `pyproject.toml` again: `gepa`
moves from the old git source to PyPI `0.1.1` (the lock went stale after
#256), and the project version syncs to `1.2.1`. **litellm stays pinned
at the known-good 1.80.0** (below the 1.88.x that 431s). The large
lockfile diff is mostly `upload-time` metadata added by the newer `uv`.

## Test Plan / Results

Local, with the exact pinned set (litellm 1.80.0, mypy 1.18.2, faiss-cpu
1.13.0, ruff 0.14.5):
```
uv export --locked --no-emit-project --no-hashes --all-extras -o /tmp/constraints.txt   # passes (lock in sync)
uv pip install -e '.[dev]' --constraint /tmp/constraints.txt
ruff check lotus/      # All checks passed!
mypy lotus/            # Success: no issues found in 60 source files
python -c "import lotus"  # OK
```
The OpenAI 431 is server-side/transient; pinning to litellm 1.80.0 is
the best in-repo mitigation. CI on this PR is the live confirmation.

## Type of Change

- [x] CI / build (non-breaking)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>