ci(rust): reject stale Cargo lockfiles

[pimlock]

Summary

Reject stale committed Cargo lockfiles before Rust validation can silently refresh them. PR #3226 demonstrates the failure mode: an independent example workspace drifted from its manifest without an existing CI failure.

Using Cargo's --locked manifest option is the standard way for CI to consume a committed dependency resolution without rewriting it. The explicit metadata pass applies that check to every tracked workspace lockfile, including standalone examples that are outside the root workspace.

Related Issue

No issue required: this is localized CI hardening prompted by #3226.

Rebased onto main, including the lockfile correction merged in #3226.

Changes

• Add a reusable script that discovers every tracked Cargo.lock and runs full cargo metadata --locked against its adjacent manifest.
• Run the guard once in the x86_64 Linux branch-check job before formatting, linting, and tests.
• Add --locked to the existing Cargo check and Clippy commands in GitHub Actions and the corresponding local mise tasks.
• Separate per-lockfile validation from discovery and aggregate failure handling, preserving Cargo diagnostics without assuming every failure means a stale lockfile.
• Document how to refresh an affected workspace's lockfile and rerun pre-commit.

Testing

• bash -n tasks/scripts/check-cargo-lockfiles.sh
• git diff --check
• Regression check before rebasing: the uncorrected lockfile fails on examples/supervisor-middleware-content-guard/Cargo.lock, matching chore(example): refresh content guard lockfile #3226.
• mise run rust:lockfiles:check passes for all four tracked lockfiles after rebasing onto main.
• mise run pre-commit passes on the rebased branch.
• Verified cargo metadata --format-version 1 --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml refreshes the stale lockfile. The temporary lockfile change was restored after validation.
• Automated regression tests omitted as requested; shell syntax and live Cargo validation cover this small CI script.
• E2E tests not applicable.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs not applicable; this changes CI enforcement, not system architecture.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.