Fail CI when the lock is stale

Runs read every project’s config from .vx/projects.lock.json, which vx lock writes. Add vx lock --check to CI to fail a change that edited a vx.config.ts without running vx lock.

vx lock --check

✗ vx lock --check  packages/ui/vx.config.ts evaluates differently from the lock here — its config, a file it imports, or the environment it reads changed; run 'vx lock'

It exits 1 and names each project that drifted. With a current lock it exits 0:

✓ vx lock --check  up to date (2 projects)

---

In GitHub Actions, run it before the build:

.github/workflows/ci.yml

- run: vx lock --check
- run: vx run build --all

See vx lock.