feat(cli): add --locks-required flag to wmill lint and sync push (#8026)

Add a --locks-required flag that fails if scripts or inline scripts
that need locks have no locks. Checks standalone scripts, flow inline
scripts, app inline scripts, and raw app backend scripts.

The flag can be set via CLI (--locks-required) or wmill.yaml config
(locksRequired: true). On sync push, verification runs before any
push operations to fail early.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

cli/src/core/conf.ts

@@ -97,6 +97,7 @@ export interface SyncOptions {
   };
   promotion?: string;
   lint?: boolean;
+  locksRequired?: boolean;
 }
 
 export interface Codebase {