fix(ai-agents): honor uv.lock during local run

[glharper]

Summary

• use uv sync --locked when a Python agent project contains both pyproject.toml and uv.lock
• treat the lock file as authoritative instead of applying additional requirements.txt installs afterward
• require uv for locked projects while preserving the existing pip fallback for unlocked projects

Testing

• go test ./internal/cmd -count=1
• go build ./...
• golangci-lint run ./internal/cmd/...
• exercised uv sync --locked --python <venv-python> --quiet against a temporary uv project and confirmed the lock file was unchanged

Fixes #9226

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Thank you for logging this issue; our team is reviewing it. If you need urgent prioritization, tag @RickWinter and @kristenwomack to let us know.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
21 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Updates local Python agent runs to honor uv.lock.

Changes:

• Uses uv sync --locked for locked projects.
• Preserves pip fallback for unlocked projects.
• Adds coverage for command selection and missing uv.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/cmd/run.go	Implements lock-aware dependency installation.
internal/cmd/run_test.go	Tests locked and fallback behavior.

[jongio]

Honoring uv.lock via uv sync --locked is the right call, and requiring uv only for locked projects while keeping the pip fallback for unlocked ones is a clean split. Tests cover the lock-authoritative, pyproject-only, requirements-only, and missing-uv paths. CI is green.