desktop: commit Cargo.lock and gate CI on it (issue 2102)

The desktop crate is a binary, and binaries commit their lockfile. Without one
every run re-resolved the graph: a tagged .deb/.AppImage/.exe couldn't be
rebuilt from its tag, any semver-compatible upstream release landed
automatically on the next build — the failure mode hardest to read, because the
commit that broke it changed nothing relevant — and Renovate had no lockfile to
bump, leaving Rust dependency movement invisible to the Dashboard.

Generated with cargo generate-lockfile inside ci-tauri:1.97, the same image CI
builds in, so the format and the picked versions are what CI would have chosen
itself. That takes the artifact-upload round-trip the issue proposed off the
table: ci-requirements.md already blesses the image for cargo fmt, and resolving
a dependency graph is no more a build than formatting is. 503 packages.

Enforcement goes on each job's FIRST cargo invocation rather than the bundle
build: cargo clippy --locked on Linux, and its own cargo fetch --locked step on
Windows, whose only crate-graph command is otherwise the cross-compile itself.
Drift fails in the first thirty seconds instead of thirty minutes in, and
everything after the gate in that job compiles the recorded versions anyway.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.forgejo/workflows/desktop.yml

@@ -52,12 +52,17 @@ jobs:
         run: npm ci && npm run build
         working-directory: frontend
 
+      # --locked on the FIRST cargo invocation of the job is the lockfile gate: it
+      # fails the run if Cargo.toml and the committed Cargo.lock disagree, instead
+      # of silently re-resolving. Everything after it in this job then compiles the
+      # exact versions recorded in the lockfile, so the flag isn't repeated on the
+      # bundle build (issue 2102).
       - name: Clippy
-        run: cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --locked --all-targets -- -D warnings
         working-directory: desktop/src-tauri
 
       - name: Test
-        run: cargo test
+        run: cargo test --locked
         working-directory: desktop/src-tauri
 
       # Deliberately AFTER clippy + test, not before.
@@ -244,6 +249,15 @@ jobs:
         run: cargo tauri icon app-icon.png
         working-directory: desktop/src-tauri
 
+      # This lane's lockfile gate (the Linux job gets it from `cargo clippy
+      # --locked`). It has to be its own step here because the build is this job's
+      # only crate-graph command, and discovering the drift 30 minutes into a
+      # cross-compile is the expensive way to learn it. Fetching for the Windows
+      # target also pre-warms exactly the crates the build will want.
+      - name: Verify the lockfile and fetch dependencies
+        run: cargo fetch --locked --target x86_64-pc-windows-msvc
+        working-directory: desktop/src-tauri
+
       # --runner cargo-xwin swaps cargo for the cross-compiling driver (it supplies
       # the MSVC CRT/SDK, pre-warmed into the image, and links with lld-link).
       # Frontend already built above; skip the beforeBuildCommand rebuild.