Use pipenv install --deploy in CI

Currently we use pipenv install --dev in the CI scripts. This will attempt to re-lock dependencies if the lockfile is out of date. I think using pipenv install --dev --deploy would be better; this will raise an error and fail if the lockfile is out of date, which seems more appropriate for the CI pipeline to me. We should not be allowing the repo to pass CI if the lockfile and Pipfile don't agree.