ci: pass --locked to cargo in check-rust and the release builds, pin cargo-xwin (#449)

check-rust.yml ran cargo check and cargo test without --locked: a
Cargo.lock out of step with Cargo.toml was rewritten in the job's
checkout, and the suppression guard, the windows-sys guard and cargo
audit then read the rewritten lockfile instead of the committed one.
Both now pass --locked, and the windows-sys guard comment says the
lockfile it reads is the committed one.

release.yml built the shipped binaries the same way. Both npx tauri
build calls now end with `-- --locked`, which the Tauri CLI hands to its
runner (cargo, or cargo-xwin for Windows, which passes it to cargo
build).

cargo-xwin, the runner of the Windows build, runs with the updater
signing key in its environment and was installed at whatever version
crates.io served on the day of the tag. It is pinned at 0.23.1, the
version the v0.17.2 release installed (run 570), and its version is
printed in the job log.

Refs #449

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/check-rust.yml

@@ -126,8 +126,15 @@ jobs:
         with:
           workspaces: "src-tauri -> target"
 
+      # --locked (#449): a Cargo.lock that no longer matches Cargo.toml (hand
+      # edit, conflict resolved badly, dependency added without its lockfile)
+      # fails the job here instead of being rewritten in the job's checkout.
+      # The guards and the audit below then read the committed lockfile, the
+      # one release.yml builds the shipped binaries from, also with --locked.
+      # A deliberate `cargo update` in a PR is not affected: it commits the
+      # lockfile it writes.
       - name: cargo check
-        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets
+        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets --locked
 
       # Anti-rot guard for the suppressions in .cargo/audit.toml (#310). Each
       # entry there is justified by its crate being absent from every shipped
@@ -218,9 +225,10 @@ jobs:
       # and a canary must be read and checked, or the loop's silence proves
       # nothing.
       #
-      # No cargo call, so neither the warm index nor --locked matters here: the
-      # step reads the lockfile as cargo check left it, which is the committed
-      # one unless cargo had to update it.
+      # No cargo call, so neither the warm index nor --locked matters here. The
+      # lockfile it reads is the committed one: cargo check runs with --locked
+      # and has already failed the job on a lockfile cargo would have had to
+      # rewrite (#449).
       - name: Verify windows-sys pinning
         run: |
           set -u
@@ -330,8 +338,9 @@ jobs:
           echo "windows-sys pinning: $checks checks, exit $rc"
           exit $rc
 
+      # --locked, as cargo check above (#449).
       - name: cargo test
-        run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets
+        run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets --locked
 
       # Prebuilt binary. `cargo install --locked cargo-audit` recompiled the
       # tool from source on every single run (~4m40s). No continue-on-error:

.forgejo/workflows/release.yml

@@ -43,7 +43,15 @@ jobs:
         run: |
           apt-get install -y lld llvm clang nsis
           rustup target add x86_64-pc-windows-msvc
-          cargo install --locked cargo-xwin
+          # Pinned (#449): cargo-xwin is the runner of the Windows build below
+          # and runs with TAURI_SIGNING_PRIVATE_KEY in its environment, so a
+          # new release of it must be a decision, not whatever crates.io serves
+          # on the day of the tag. 0.23.1 is the version the v0.17.2 release
+          # installed unpinned (run 570). A version without an operator makes
+          # cargo install exactly that one. Bump it on purpose, after reading
+          # what the new version changes.
+          cargo install --locked cargo-xwin --version 0.23.1
+          cargo-xwin --version
 
       - name: Install frontend dependencies
         run: npm ci
@@ -53,14 +61,21 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
-          npx tauri build --bundles deb,rpm
+          # Arguments after -- go to the runner (#449): cargo here, cargo-xwin
+          # in the Windows step, which hands them to cargo build. --locked
+          # builds the shipped binaries from the committed Cargo.lock, or fails
+          # rather than rewrite it. The log never prints the cargo command
+          # line: only a build that fails on a lockfile out of step with
+          # Cargo.toml proves the flag gets there.
+          npx tauri build --bundles deb,rpm -- --locked
 
       - name: Build Tauri Windows
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
-          npx tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc
+          # -- --locked: see the Linux build above (#449).
+          npx tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc -- --locked
 
       - name: Collect release files
         run: |