Fail fast on Poetry lock drift and invalidate stale CI venv caches

[Copilot]

The failing tox (3.12) job was not a Python 3.12 runtime issue; CI was failing earlier in the shared Poetry setup step because pyproject.toml and poetry.lock had drifted. This change makes that failure explicit and ensures dependency caches refresh when project metadata changes.

• Poetry setup hardening

  • Add an explicit lock validation step in the shared .github/actions/setup-poetry action:
    • poetry check --lock
  • This surfaces lock drift immediately instead of failing later during poetry install --no-root.

• Cache invalidation correctness

  • Update the cached .venv key to include both pyproject.toml and poetry.lock.
  • This prevents reuse of environments built against outdated dependency metadata.

• Effect on the failing workflow

  • tox (3.12) now gets a deterministic setup path:
    • valid lockfile → reuse/install dependencies normally
    • invalid lockfile → fail early with a clear cause

- name: Validate lock file
  run: poetry check --lock
  shell: bash

with:
  path: .venv
  key: venv-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles('pyproject.toml', 'poetry.lock') }}