Add hash-locked fixed conformance jobs for companyscope-incident-register and sentinel #248

Checked at c6f204e. Follow-up to #247, which added floating conformance jobs for both integrations.

companyscope-incident-register-conformance.yml and sentinel-conformance.yml install their dependencies unpinned (pip install agent-manifest pytest, and sentinel's range-based requirements-dev.txt). That matches the template, but the repo's established pattern pairs each floating job with a fixed job that installs with --require-hashes. See aeoess-aps-conformance.yml: its fixed job installs from requirements/aeoess-aps-fixed.txt and then checks the pinned versions against integration.yaml.

Done when, for each of the two integrations:

• a requirements/<integration>-fixed.in and its hash-locked .txt, generated with uv pip compile requirements/<integration>-fixed.in --generate-hashes --universal --python-version 3.11 -o requirements/<integration>-fixed.txt, the same command the other locks record in their header
• a fixed job in the integration's workflow that installs with pip install --require-hashes -r that file and runs the same tests
• both new jobs green on 3.11 to 3.13

Note: integrations/sentinel/requirements.lock.txt still pins urllib3==2.7.0, which pip-audit flags (CVE-2026-97687); the new sentinel lock should resolve 2.8.0 or later.

Files: two .in files, two generated .txt files, and the two existing workflows.