fix(build): configure Docker pip mirrors with locked fallback [skip ci]

tests/test_ci_install.py

@@ -83,3 +83,27 @@ def test_sequential_fallback_keeps_editable_and_isolation(
     output = capsys.readouterr().out
     assert "fixture-secret" not in output and "fixture-token" not in output
     assert "mirror.example" in output and "pypi.org" in output
+
+
+def test_docker_locked_install_has_independent_index_and_fallback(
+    installer, monkeypatch
+):
+    monkeypatch.setattr(installer.sys, "argv", ["install.py", "--locked"])
+    monkeypatch.setenv("CI_PIP_INDEX_URL", "https://ci.example/simple")
+    monkeypatch.setenv("DOCKER_PIP_INDEX_URL", "https://docker.example/simple")
+    monkeypatch.setenv("DOCKER_PIP_FALLBACK_INDEX_URL", "https://pypi.org/simple")
+    calls = []
+
+    def run(command, **kwargs):
+        if "config" in command:
+            return SimpleNamespace(returncode=0, stdout="")
+        calls.append((command, kwargs["env"]))
+        return SimpleNamespace(returncode=0 if len(calls) == 2 else 1, stdout="")
+
+    monkeypatch.setattr(installer.subprocess, "run", run)
+    installer.main()
+    assert [env["PIP_INDEX_URL"] for _, env in calls] == [
+        "https://docker.example/simple",
+        "https://pypi.org/simple",
+    ]
+    assert all(command[-2:] == ["-r", "requirements.lock"] for command, _ in calls)