.terraform.lock.hcl records the exact provider versions selected and their checksums for each platform. It is created by terraform init and is intended to be committed to version control, in the same spirit as a package lockfile. Without it, init re-resolves version constraints and a CI run can pick a newer provider than the one the change was tested against.
Two details cause trouble. The lock file records checksums only for platforms init has seen, so a lock generated on macOS fails on a Linux CI runner with provider ... does not have a package available for your current platform even though the version is right. Fix it by running terraform providers lock -platform=linux_amd64 -platform=darwin_arm64 and committing the result.
Second, the lock covers providers only. Module versions are not locked; a module sourced from a registry with a ~> constraint resolves fresh on every init, and a module sourced from a Git branch resolves to whatever that branch currently points at. Pin module sources to exact tags or commit SHAs. terraform init -upgrade is the command that deliberately re-resolves and rewrites the lock.