ci: replace highest resolution with locked in test matrix

The 'highest' resolution strategy was causing CI failures because it
was picking up ruff==0.14.12 which doesn't have wheels for win_amd64
and some Linux glibc versions.

Replace it with 'locked' which uses the frozen lockfile versions,
providing more stable CI while still testing lowest-direct for minimum
version compatibility.

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 1
Claude-Permission-Prompts: 1
Claude-Escapes: 0

Author: maxisbey

.github/workflows/shared.yml

@@ -39,8 +39,8 @@ jobs:
         dep-resolution:
           - name: lowest-direct
             install-flags: "--upgrade --resolution lowest-direct"
-          - name: highest
-            install-flags: "--upgrade --resolution highest"
+          - name: locked
+            install-flags: "--frozen"
         os: [ubuntu-latest, windows-latest]
 
     steps: