Use frozen mode for bundle install in CI

This ensures CI fails immediately with a clear error if Gemfile.lock
is out of sync, rather than silently updating it.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: horgh

.github/workflows/release.yml

@@ -30,6 +30,8 @@ jobs:
           ruby-version: ruby
 
       - run: bundle install
+        env:
+          BUNDLE_FROZEN: true
 
       # zizmor complains that 'v1' is a ref that can be provided by both the branch and tag namespaces.
       # specify that we want the v1 branch.

.github/workflows/rubocop.yml

@@ -23,4 +23,6 @@ jobs:
           ruby-version: 3.4
 
       - run: bundle install
+        env:
+          BUNDLE_FROZEN: true
       - run: bundle exec rake -t rubocop

.github/workflows/test.yml

@@ -38,4 +38,6 @@ jobs:
           ruby-version: ${{ matrix.version }}
 
       - run: bundle install
+        env:
+          BUNDLE_FROZEN: true
       - run: bundle exec rake -t spec