[bazel] Enforce up-to-date lock file in CI (#8860)

The Bazel lock file was missing a few dependencies. This adds a check in
CI that the lock file is up-to-date.

.github/workflows/bazel.yml

@@ -137,6 +137,27 @@ jobs:
           path: "*-bazel-lint-fixes.patch"
         if: ${{ failure() }}
 
+  mod-lock:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check lockfile
+        run: bazel mod deps --lockfile_mode=error
+
+      - run: bazel mod deps --lockfile_mode=update
+        if: ${{ failure() }}
+
+      - name: Generate diff
+        run: git diff HEAD > bazel-mod-lock-fixes.patch
+        if: ${{ failure() }}
+
+      - uses: actions/upload-artifact@v7
+        with:
+          archive: false
+          path: "bazel-mod-lock-fixes.patch"
+        if: ${{ failure() }}
+
   non_robotpy_pregeneration:
     name: "Non-RobotPy Pregen"
     runs-on: ubuntu-24.04