fix(docker): lock the e2e runner's cargo test dependency graph

[OlympusLedgerOrg]

Summary

Follow-up to the CodeRabbit review round on #1567. Re-checked every item from that review against current main before touching anything:

• Admin key interpolation (docker/compose.audit.yml, both services) — already on main: OLYMPUS_ADMIN_KEY: ${OLYMPUS_ADMIN_KEY:?set OLYMPUS_ADMIN_KEY before running the audit harness}.
• Headless production refusal gate (src-tauri/src/bin/olympus-server.rs) — already on main: OLYMPUS_ENV=production/prod exits 2 before any DB work.
• DATABASE_URL-free error message — already on main: generic "Could not connect to external database..." message, no interpolated URL.
• Embedded-Postgres cleanup on both shutdown paths — already on main: bind-failure path calls stop_db() before exit(2); normal shutdown reports stop_db() errors instead of unconditionally claiming success.
• docker/Dockerfile.audit --locked — already on main.
• DOCKER-APP-TESTING-2026-07-28.md — already on main: output fences tagged text, run instructions require OLYMPUS_ADMIN_KEY.

One gap remained: the e2e service's cargo test invocation in docker/compose.audit.yml was still missing --locked, so the audit-image builder stage could silently resolve a different dependency graph for the test binary than Cargo.lock pins (the Dockerfile.audit build step already had this flag, but the compose-level test command didn't). This PR adds it.

Test plan

• cat docker/compose.audit.yml | pnpm exec prettier --check --stdin-filepath docker/compose.audit.yml — passes clean
• Local pre-push gate (cargo clippy --workspace -D warnings, full nextest suite incl. embedded-Postgres binaries, doctests) — all green
• Verified by grep that items 1–4 and 6 from the review are present on main prior to this change

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved end-to-end test reliability by ensuring dependency versions match the project lockfile during test execution.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 64a6083d-2882-475d-a9fa-1fee0ad39e71

📥 Commits

Reviewing files that changed from the base of the PR and between be49393 and 1a6ec81.

📒 Files selected for processing (1)

• docker/compose.audit.yml

---

📝 Walkthrough

Walkthrough

The audit E2E runner now passes Cargo’s --locked flag. Cargo must use the existing lockfile during test execution.

Changes

Audit E2E test execution

Layer / File(s)	Summary
Lockfile-enforced test command docker/compose.audit.yml	The E2E Cargo test command now includes --locked.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• OlympusLedgerOrg/Olympus#1592: Both changes modify the Cargo test command in docker/compose.audit.yml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding locked Cargo dependency resolution to the E2E runner.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}