While perhaps only a mild inconvenience, if the commited version MODULE.bazel.lock gets out of sync it can cause significant confusion. Consider implementing a check that prevents it from falling out of sync.

I haven't tried it out, but my first through would be to add --lockfile_mode=error to the bazel_run_lint task.

https://bazel.build/reference/command-line-reference#common_options-flag--lockfile_mode