chore(ci): Check pixi lock (#3533)

Unlike `uv sync --frozen`, `pixi install --frozen` does not seem to
check whether the lock file is out-of-sync with `pyproject.toml`. This
adds a small job to the Docker build workflow to run `pixi lock
--check`.

It should fail, and then I'll run `pixi.lock`.

Author: effigies

.github/workflows/docker.yml

@@ -18,6 +18,22 @@ env:
   FORCE_COLOR: true
 
 jobs:
+  check-pixi:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 200
+          fetch-tags: true
+      - uses: prefix-dev/[email protected]
+        with:
+          pixi-version: v0.55.0
+          run-install: false
+      - run: pixi lock --check
+
   build-container:
     runs-on: ubuntu-latest
     permissions: