ci: assert the root Cargo.lock is in sync

[matthewevans]

--locked on the existing workspace clippy invocation costs no extra CI time --
that step already resolves the whole workspace -- and turns silent lockfile drift
into a fast, explicit failure.

Without it, removing a crate leaves its dependency subtree stranded in
Cargo.lock, every later cargo invocation rewrites the file in place, and CI stays
green because no root-workspace command passed --locked. Nightly Release is
where it surfaces, because cargo release --execute aborts on a dirty tree:

error: uncommitted changes detected, please resolve before release:
         Cargo.lock (Status(WT_MODIFIED))

That is exactly how #7556 (remove mtgish importer) broke three consecutive
nightlies before #7588 resynced the lock. --locked was already used for the
Tauri manifest; this extends the same guarantee to the root workspace.

Verified both directions against origin/main in an isolated worktree: with the
pre-#7588 lockfile the guarded command exits 101 in under two seconds on
"cannot update the lock file ... because --locked was passed", before compiling
anything; with the current lockfile it clears resolution and proceeds to compile
normally.

Claude-Session: https://claude.ai/code/session_01DJgbxMGnPi6MFfGUe15Y3P

Summary by CodeRabbit

• Chores
  • Updated continuous integration checks to verify that the committed dependency lockfile remains synchronized with project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ffcc7c3d-45b3-4bfa-9396-7732bd1d1020

📥 Commits

Reviewing files that changed from the base of the PR and between 9f1cfcc and 618487a.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The CI workflow updates the Rust Clippy command to use --locked. The workflow also documents that dependency resolution must match the committed Cargo.lock.

Changes

CI validation

Layer / File(s)	Summary
Clippy lockfile enforcement .github/workflows/ci.yml	The Clippy step uses --locked and documents the required lockfile synchronization.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 61848

The CI change makes root Cargo.lock drift fail fast instead of allowing later commands to rewrite it; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: lgray

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main CI change: using the root Cargo.lock to verify workspace synchronization.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ship/ci-assert-cargo-lock-in-sync

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}