chore(host): add the two missing crates to src/host/Cargo.lock

[hyperpolymath]

What this is

src/host/Cargo.lock was missing two of the crates src/host depends on, so
cargo build --locked could not succeed against this tree.

src/host_core/Cargo.toml requires ptype_format and
paint_type_plugins = { path = "../plugins", package = "paint-type-plugins" }.
Neither appeared in the lock.

Why it matters

No workflow in this repository has ever built paint-type, the binary
src/host produces. host.yml builds the src/interface/ffi Zig library and runs
cargo test against host_core, which has no gossamer-rs dependency and never
links GTK. So this lock has never been exercised, and its staleness has never
surfaced.

This PR is the prerequisite for changing that. It does nothing else.

How it was produced

cargo build, not cargo generate-lockfile. That distinction is the whole
point: generate-lockfile re-resolves every dependency and may bump all 25
existing entries to latest. A plain build adds only what is missing.

Result: 25 packages → 29, add-only.

🚨 Review this by command, not by eye

.gitattributes:57 marks Cargo.lock as -diff, so GitHub renders this PR as
Binary files differ, 0 insertions, 0 deletions. There is no visible diff to review.

git show <sha>:src/host/Cargo.lock | grep -c '^name = '                    # 29
git show <sha>:src/host/Cargo.lock | grep -c 'name = "ptype_format"'       # 1
git show <sha>:src/host/Cargo.lock | grep -c 'name = "paint-type-plugins"' # 1

And the assertion that actually matters:

diff <(git show origin/main:src/host/Cargo.lock | grep -A1 '^name = ') \
     <(git show <sha>:src/host/Cargo.lock       | grep -A1 '^name = ') | grep '^<'

This prints nothing. All 25 pre-existing name/version pairs are byte-identical.
A diffless PR is exactly where a silent dependency bump would hide, so that check
is not a formality.

Verified locally

With this lock in place, and the two Zig libraries built with Zig 0.15.1
(bare zig on the dev machine is 0.16.0 and breaks the gossamer build):

• cargo build --release --locked --manifest-path src/host/Cargo.toml succeeds.
• The resulting paint-type binary launches, holds a GTK window and a WebKit
  view, and draws to a canvas — proven against a same-run blank baseline, not
  against a PNG-validity check, which passes on a blank canvas.

Wiring that proof into CI is the next PR. This one only unblocks --locked.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• src/host/Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 21a4d3a3-c77a-46f2-804a-d3e2980f2732

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}