ci: stop required checks from skipping when locks fail

[lazerg]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

lint, build, test and test-httpx2 declare needs: dependency-locks, so a failing lock check skips all four. The main ruleset requires those checks but not dependency lock freshness, and GitHub counts a skipped required check as satisfied, so lint, build and test (HTTPX2) stop gating in the one run where the lockfile is known to be wrong. The two matrix contexts differ: a skipped matrix job reports once under the unexpanded name, so test (Python 3.10) and test (Python 3.14) never report and the queue waits them out instead.

The four jobs now run with !cancelled() and fail on their first step when dependency-locks did not succeed. That step runs before actions/checkout, so nothing from an unverified lockfile is fetched, installed or executed, and the required checks report red instead of disappearing. Same-repo pull requests still skip by design, and the merge queue still does the real run.

test_required_checks_fail_when_dependency_provenance_fails pins the guard next to the existing workflow assertions in tests/test_uv_workflows.py, which already infer reachability from needs. I also ran it on a fork with a stale uv.lock: lint, build and both test legs failed at Require fresh dependency locks with every later step skipped.

Additional context & links

Fixes #3755

Adding dependency lock freshness to the required checks would close the same hole without a workflow change, if you would rather do it there. A composite action would have avoided the repetition, but a local action only loads after actions/checkout, which is what the guard has to run before.