feat(cli): add lockfile support to pywrangler sync command

[ryanking13]

pywrangler sync will now generate a pylock.toml file that locks the installed packages. Rerunning pywrangler sync will now keep the existing installed versions and will not upgrade packages silently.

Also added --upgrade flag to pywrangler sync which upgrades the packages in the lockfile.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds lockfile support (pylock.toml) to pywrangler sync, using uv pip compile to pin dependency versions and a new --upgrade flag to refresh them. Overall the approach is sound. A couple of issues below.

1. _read_lockfile_requirements will crash with an opaque KeyError on malformed lockfile entries (medium severity)
2. Private function _get_lockfile_path is imported across module boundaries (low severity)

[ask-bonk]

Review posted on PR #108. Two issues flagged:

1. Medium severity: _read_lockfile_requirements at packages/cli/src/pywrangler/resolve.py:109 will crash with a bare KeyError if a [[packages]] entry in pylock.toml is missing name or version. Posted a suggestion to validate entries and skip malformed ones with a warning.

2. Low severity: _get_lockfile_path is a private function (underscore-prefixed) being imported across module boundaries (sync.py imports it from resolve.py). Suggested renaming to get_lockfile_path to signal it's part of the public API.

github run