Commit poetry.lock for reproducible CI installs (dependency hygiene baseline)

[jhamon]

Problem

poetry.lock is git-ignored (last line of .gitignore) and no lockfile is committed. CI installs run unpinned resolution on every run across a macOS/Windows/Ubuntu x Python 3.9–3.12 matrix, so builds are not reproducible and a transitive dependency can change behavior between runs without any code change. This also blocks clean, verifiable dependency-upgrade PRs. (Dependabot open alerts: 0 at audit time.)

Proposed fix & acceptance

• Decide lockfile policy for this library; recommended: stop ignoring poetry.lock, commit it, and have CI use poetry install against the committed lock.
• Remove the poetry.lock line from .gitignore if adopting the lockfile.
• Acceptance: a committed lockfile exists; CI installs from it; a clean checkout resolves identical dependency versions.

Blast radius

needs-verification (changes how CI resolves deps; run the full matrix once after committing).

Depends on

nothing (prerequisite for the cohere/dev-dep upgrade issue)