Error when buf.yaml dep is missing from buf.lock

[stefanvanburen]

When a module is added to buf.yaml deps but buf dep update has not been
run, the module is absent from buf.lock entirely. Previously this caused
two bad outcomes depending on whether any proto files imported from the
missing dep:

• If proto files imported from it: a confusing protoc-level "file not
  found" error with no mention of buf.lock or what to do.
• If proto files did not yet import from it: MalformedDepsForWorkspace
  would flag it as MalformedDepTypeUnused, suggesting the user remove
  the dep — the opposite of the right advice.

Fix this by checking, during workspace construction, that every module
declared in buf.yaml deps has a corresponding entry in buf.lock. If any
are missing, return an actionable error immediately:

"buf.testing/acme/extension" declared in buf.yaml deps but not present
in buf.lock; run "buf dep update" to update the lock file

The check is added to both the v1 and v2 workspace construction paths
in workspace_provider.go and requires no network call — it is a pure
comparison of module full names between the two config files.

Two test cases are added: one where the missing dep is not yet used in
any proto file (previously: silent success with a misleading "unused"
warning), and one where the missing dep is actively imported (previously:
cryptic "file not found" from the compiler).

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	May 7, 2026, 6:21 PM