Sync Cargo.lock before cargo build --locked in release workflow

.github/workflows/release.yml

@@ -22,6 +22,14 @@ jobs:
       - name: Install musl tools
         run: sudo apt-get update && sudo apt-get install -y musl-tools
 
+      # Sync `Cargo.lock` to the tag's `Cargo.toml` version before `--locked`
+      # enforcement. `scripts/release.sh` already runs `cargo check` to do
+      # this before pushing the tag, but a manually-bumped `Cargo.toml`
+      # pushed straight to a tag would otherwise leave `Cargo.lock` stale
+      # and the build step would fail silently (no asset uploaded).
+      - name: Sync Cargo.lock to workspace
+        run: cargo update --workspace
+
       - name: Build release binary
         run: cargo build --release --locked --target x86_64-unknown-linux-musl