fix(ci): uv.lock recorded 1.4.0, so every locked lane died before testing

The v1.5.0 lock was generated before the version bump, so its own
[[package]] entry said autocad-mcp-pro 1.4.0 while pyproject said 1.5.0.
No dependency differed -- the transitive graph is byte-identical -- but
`uv sync --locked` will not re-resolve, so lint, test-linux 3.11,
test-linux 3.12 and test-windows all failed at install before running a
single test.

`uv lock` fixes it in one line. The gate that should have caught it did
not exist: test_release_consistency chains pyproject -> version.py ->
CHANGELOG -> README -> server.json, and the lockfile was the one release
artifact carrying a version string nothing checked. Added
test_uv_lock_records_the_pyproject_version, verified RED against the
broken lock and green against the fixed one.

Reproduced the CI lanes locally into a throwaway environment before
pushing this time: `uv sync --locked --only-group dev`, then
`--locked --extra pdf`, then ruff and pytest under `uv run --no-sync`.
1242 passed, 1 xfailed.

README test-count snapshot 1242 -> 1243 for the new gate.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_release_consistency.py

@@ -196,6 +196,37 @@ def test_server_json_versions_match_pyproject() -> None:
             assert package["identifier"] == _pyproject()["project"]["name"]
 
 
+def test_uv_lock_records_the_pyproject_version() -> None:
+    """`uv sync --locked` refuses a lock that disagrees with pyproject.
+
+    This one is cheap and was learned the expensive way. The v1.5.0 lock was
+    generated before the version bump, so it recorded the project's own package
+    as 1.4.0 while pyproject said 1.5.0. No dependency differed — the whole
+    transitive graph was identical — but `--locked` will not re-resolve, so
+    every locked CI lane (lint, test-linux 3.11, test-linux 3.12, test-windows)
+    died on `uv sync` before running a single test.
+
+    The rest of this module chains pyproject -> version.py -> CHANGELOG ->
+    README -> server.json. The lockfile was the one release artifact carrying a
+    version string that nothing checked.
+    """
+    lock = (ROOT / "uv.lock").read_text(encoding="utf-8")
+    name = _pyproject()["project"]["name"]
+    expected = _pyproject_version()
+
+    match = re.search(
+        rf'^\[\[package\]\]\nname = "{re.escape(name)}"\nversion = "([^"]+)"',
+        lock,
+        re.MULTILINE,
+    )
+    assert match, f"uv.lock has no [[package]] entry for {name!r}"
+    assert match.group(1) == expected, (
+        f"uv.lock records {name} {match.group(1)} but pyproject says {expected} — "
+        "run `uv lock` after bumping the version, or every locked CI lane fails "
+        "at `uv sync --locked` before a test runs"
+    )
+
+
 def test_readme_contains_mcp_name_marker() -> None:
     """PyPI ownership validation for the MCP registry needs this marker in the
     README (which ships to PyPI as the long description)."""