Reproducible builds (lockfile pinning)

Pinning exact dependency versions in a committed lockfile and enforcing it in CI with --locked so every build is deterministic and cannot silently drift.

grounded in: doctrine's rule 'Dependencies are PINNED in Cargo.lock and CI enforces it with --locked' plus the build-hardening record (committed Cargo.lock + --locked)