ci(rust-ci-reusable): pass --locked to cargo check/clippy/test (closes #295) (#299)

## Summary

Adds `--locked` to all three cargo invocations in `rust-ci-reusable.yml`
(`check`, `clippy`, `test`). The reusable is consumed estate-wide via
thin wrappers; this change fans out automatically.

## Why

`hyperpolymath/echidna` had five dependabot major-version bumps merge
2026-05-29 (axum 0.7→0.8, rand 0.9→0.10, criterion 0.5→0.8, nom 7→8,
rustyline 15→18) without paired code updates. Locally `cargo check
--locked` failed with "cannot update the lock file because --locked was
passed", proving the workspace needed something the lockfile couldn't
satisfy. CI lacked `--locked`, silently re-resolved to the newer
transitives, and broke compile on every push for ~24h until echidna#128
reverted.

## Effect

The next dependabot major bump that breaks compile fails at PR time —
where it's cheap to revert/fix — instead of merging green and breaking
everyone downstream.

## Caller-side considerations

- Repos that ship intentionally-stale lockfiles will see new CI
failures. Those repos should run `cargo update` and commit the fresh
lock; this is the correct "sync your lockfile to Cargo.toml" signal.
- Repos that don't ship `Cargo.lock` (libraries with no application
root) won't be affected — `--locked` is a no-op when there's nothing to
lock.

## Test plan

- [ ] CI: this PR's own rust-ci passes with the new `--locked`
constraint.
- [ ] After merge: monitor downstream rust-ci wrappers for first-time
`--locked` failures (those are the repos that need their lockfile
synced).

Closes #295.

Author: hyperpolymath

.github/workflows/rust-ci-reusable.yml

@@ -130,13 +130,17 @@ jobs:
           workspaces: ${{ inputs.working_directory }}
 
       - name: Cargo check
-        run: cargo check ${{ inputs.check_args }}
+        # `--locked` so CI honours `Cargo.lock` and surfaces dep drift the
+        # first push it happens, instead of silently re-resolving (which
+        # masked the echidna#92 / echidna PR #128 dependabot major-bump
+        # break for 24h). See standards#295.
+        run: cargo check --locked ${{ inputs.check_args }}
 
       - name: Cargo fmt
         run: cargo fmt --all -- --check
 
       - name: Cargo clippy
-        run: cargo clippy ${{ inputs.clippy_args }}
+        run: cargo clippy --locked ${{ inputs.clippy_args }}
 
   test:
     name: Cargo test
@@ -164,7 +168,8 @@ jobs:
           workspaces: ${{ inputs.working_directory }}
 
       - name: Run tests
-        run: cargo test ${{ inputs.test_args }}
+        # `--locked` — see Cargo check above.
+        run: cargo test --locked ${{ inputs.test_args }}
 
       - name: Write summary
         if: always()