Sync Cargo.lock before cargo build --locked in release workflow (#204)

The release for v0.1.1 was tagged with a Cargo.toml bumped to 0.1.1
but Cargo.lock still listing 0.1.0; `cargo build --locked` failed,
the Publish GitHub Release step was skipped, and the release was
created with no assets attached.

`scripts/release.sh` regenerates Cargo.lock before the tag is
pushed, so the common path is already safe. This step adds a
fallback so a tag created without going through that script (or
where the lockfile drifted for any other reason) still produces
a release artifact instead of an empty release object.

Author: rockbmb

.github/workflows/release.yml

@@ -22,6 +22,14 @@ jobs:
       - name: Install musl tools
         run: sudo apt-get update && sudo apt-get install -y musl-tools
 
+      # Sync `Cargo.lock` to the tag's `Cargo.toml` version before `--locked`
+      # enforcement. `scripts/release.sh` already runs `cargo check` to do
+      # this before pushing the tag, but a manually-bumped `Cargo.toml`
+      # pushed straight to a tag would otherwise leave `Cargo.lock` stale
+      # and the build step would fail silently (no asset uploaded).
+      - name: Sync Cargo.lock to workspace
+        run: cargo update --workspace
+
       - name: Build release binary
         run: cargo build --release --locked --target x86_64-unknown-linux-musl