feat(cli): add --locks-required flag to wmill lint and sync push (#8026)

Add a --locks-required flag that fails if scripts or inline scripts
that need locks have no locks. Checks standalone scripts, flow inline
scripts, app inline scripts, and raw app backend scripts.

The flag can be set via CLI (--locks-required) or wmill.yaml config
(locksRequired: true). On sync push, verification runs before any
push operations to fail early.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

cli/src/utils/script_common.ts

@@ -39,6 +39,19 @@ export const workspaceDependenciesLanguages: WorkspaceDependenciesLanguage[] = [
   { language: "go", filename: "go.mod" },
 ] as const;
 
+/**
+ * Returns true if a script in the given language requires a lock file.
+ * Matches the condition in updateScriptLock (metadata.ts).
+ */
+export function languageNeedsLock(language: ScriptLanguage | string): boolean {
+  return (
+    workspaceDependenciesLanguages.some((l) => l.language === language) ||
+    language === "deno" ||
+    language === "rust" ||
+    language === "ansible"
+  );
+}
+
 export function inferContentTypeFromFilePath(
   contentPath: string,
   defaultTs: "bun" | "deno" | undefined