ci: enforce the committed lockfile

[meop]

Summary

• add --locked to Clippy
• pass --locked through both Cargo and cross build/test paths
• ensure CI and release artifacts use the committed dependency resolution

Dust is a binary application with a committed Cargo.lock. Without --locked, Cargo can repair manifest/lockfile drift only inside a runner, leaving normal CI green while a stricter downstream or release invocation fails.

Validation

• cargo check --locked --all-targets
• git diff --check

Prepared with assistance from OpenAI Codex; the commit includes a Co-authored-by trailer.