ci(rust): reject stale Cargo lockfiles

[pimlock]

Summary

Reject stale or silently rewritten Cargo lockfiles during Rust validation. Each Rust CI job finishes by validating every tracked workspace lockfile and checking that none differs from the checked-out commit. A successful build that refreshed a lockfile therefore still fails CI.

Local Rust lint, check, and test tasks validate lockfiles before running, including through pre-commit and local CI. Ordinary Cargo commands retain their normal behavior; --locked is confined to the metadata guard.

Related Issue

No issue required: localized CI hardening prompted by #3226, where a standalone example lockfile had drifted outside the root Cargo workspace. The branch includes the correction merged in #3226.

Changes

• Discover every tracked Cargo.lock and validate it against its adjacent manifest using full cargo metadata --locked, preserving Cargo diagnostics.
• Finish every Rust branch-check matrix job with metadata validation and git diff --exit-code HEAD -- ':(glob)**/Cargo.lock', including after earlier failures.
• Make local Rust lint, check, and test tasks depend on the metadata guard, preventing those commands from refreshing a stale lockfile before it is checked.
• Run strict Clippy for both standalone examples, with all targets and warnings denied.
• Document the final CI check, local task ordering, dependency-cache implications, and lockfile refresh instructions.

Testing

• mise run pre-commit passes, including all four lockfile validations and strict Clippy for the workspace, E2E crate, and both examples. The log confirms the guard finishes before Clippy starts.
• Shell syntax validation for the lockfile and feature-alias scripts.
• git diff --check.
• Exercised the exact final Git diff command in a temporary repository: a clean checkout passes; root and nested lockfile edits, staged edits, and deletions fail.
• Earlier validation reproduced the stale example lockfile from before chore(example): refresh content guard lockfile #3226 and confirmed that refreshing it with Cargo metadata resolves the failure.
• No persistent regression test suite added, as previously requested. No runtime behavior changed; E2E tests are not applicable.

Checklist

• Follows Conventional Commits.
• Commits are signed off for DCO.
• Testing guidance and build architecture documentation updated.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[elezar]

I think this looks good. Should this also be a precommit step or is that too heavyweight?

[pimlock]

I think this looks good. Should this also be a precommit step or is that too heavyweight?

The rust lint (which is now --locked) is running as part of pre-commit, but I think adding that more generic check in there makes sense as well and it doesn't add much (it's pretty much a repeat of what the --locked is doing, but with discovery of all potential spots).