Builders ignore lock files, breaking reproducible builds

[yzx9]

PixiBuilder and UvBuilder do not utilize lock files during environment builds. Each build resolves dependencies from scratch using only the declaration file (e.g., pixi.toml, pyproject.toml), making builds non-reproducible.

Current Behavior

UvBuilder

• Calls uv sync without --frozen or --locked, so uv re-resolves dependencies every time
• User-provided uv.lock is never copied to the environment directory
• uv.lock is generated as a side effect but never read or used for staleness checks

PixiBuilder

• Calls pixi install without --locked, so pixi re-resolves dependencies every time
• User-provided pixi.lock is never copied to the environment directory
• pixi.lock is parsed only for progress bar package counting (PixiInstallMonitor), not for build decisions

MambaBuilder

• Not affected — conda/micromamba has no lock file mechanism

Expected Behavior

• Builders should accept a user-provided lock file (e.g., .lockFile(File) or .lockContent(String))
• The lock file should be copied to the environment directory before install
• Install commands should use --locked/--frozen flags to enforce strict lock file adherence
• appose.json state should include lock file hash so that lock file changes trigger rebuilds

Impact

Without lock file support, two builds from the same declaration file can produce different environments if dependency versions have changed upstream. This is a problem for reproducibility in scientific computing workflows.

[yzx9]

Workaround:

// Stage uv.lock into envRoot so `uv sync` honors the locked dependency
// versions. UvBuilder writes pyproject.toml to envRoot and runs `uv sync`
// with cwd=envRoot, so uv.lock must live at envRoot/uv.lock to be
// discovered. Workaround for apposed/appose#33 (Appose has no lock API yet).
final File lockSource = new File(sourceDir, "uv.lock");
final String lockContent;
if (lockSource.isFile()) {
  lockContent = new String(java.nio.file.Files.readAllBytes(lockSource.toPath()), "UTF-8");
  invalidateIfLockChanged(envRoot, lockContent);
  final File stagedLock = new File(envRoot, "uv.lock");
  stagedLock.getParentFile().mkdirs();
  Files.write(stagedLock.toPath(), lockContent.getBytes("UTF-8"));
} else {
  lockContent = null;
  log.warn("uv.lock not found at " + lockSource.getAbsolutePath()
    + " — managed env will NOT be reproducible");
}

// ...

// NB: We intentionally do NOT pass `--frozen` here. Appose's `.flags(...)`
// are emitted BEFORE the subcommand (uv --frozen sync ...), but uv only
// accepts `--frozen` AFTER `sync` (uv sync --frozen), so it would error.
// Instead we rely on staging uv.lock into envRoot above: plain `uv sync`
// honors a lock that is consistent with pyproject.toml and installs the
// exact pinned versions. True strict `--frozen` needs upstream
// apposed/appose#33 (post-subcommand arg injection). See plan caveats.
final org.apposed.appose.Builder builder = Appose.uv()
  .content(pyprojectContent)
  .scheme("pyproject.toml")