fix(deps): make hash locks cross-platform

Signed-off-by: Haozhe Wu <haozhe_wu@connect.hku.hk>

.github/workflows/test.yml

@@ -11,6 +11,44 @@ on:
   workflow_dispatch:
 
 jobs:
+  hash-lock:
+    name: Hash lock / ${{ matrix.name }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux x64
+            runner: ubuntu-24.04
+            architecture: x64
+          - name: macOS ARM64
+            runner: macos-15
+            architecture: arm64
+          - name: Windows x64
+            runner: windows-2025
+            architecture: x64
+
+    steps:
+      # actions/checkout v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      # actions/setup-python v7.0.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: "3.11"
+          architecture: ${{ matrix.architecture }}
+          cache: pip
+
+      - name: Verify hash-locked dependencies
+        # Both locks, separately: each must be internally complete on its own,
+        # because the Docker build installs them as two independent
+        # --require-hashes passes. A native matrix is required because package
+        # markers are evaluated for the host running pip.
+        run: |
+          python -m pip install --dry-run --ignore-installed --require-hashes -r requirements-lock.txt
+          python -m pip install --dry-run --ignore-installed --require-hashes -r requirements-channels-lock.txt
+
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -23,15 +61,6 @@ jobs:
           python-version: "3.11"
           cache: pip
 
-      - name: Verify hash-locked dependencies
-        # Both locks, separately: each must be internally complete on its own,
-        # because the Docker build installs them as two independent
-        # --require-hashes passes. Verifying only the main lock would let the
-        # channel lock rot until a release build failed.
-        run: |
-          pip install --dry-run --ignore-installed --require-hashes -r requirements-lock.txt
-          pip install --dry-run --ignore-installed --require-hashes -r requirements-channels-lock.txt
-
       - name: Install dependencies
         # `openbb` is included so agent/tests/test_openbb_bridge actually runs:
         # those tests importorskip on openbb_ai, so without the extra the whole