ci: the Rust lane was only ever checking one crate of three

The Clippy, Test and fmt steps ran with `working-directory: desktop/src-tauri`,
so cargo scoped them to the desktop PACKAGE. That was right while the desktop
was the only Rust in the repo. Extracting the core (M12 step 1) made it wrong
and nothing said so:

  * the core's 89 tests have not run in CI since that extraction. They used to,
    as part of the desktop crate, and moving the files out of that directory
    quietly took them out of the lane.
  * `android/ffi` was never compiled at all. I claimed the previous commit was
    verified by this lane; it wasn't. Run 3928 went green without the word
    "uniffi" appearing anywhere in its log.

Both crates still COMPILE, because the desktop depends on the core — which is
precisely why the hole was invisible. A green run kept meaning less than it
looked like it meant, and the tell was there to be read: the test output listed
`thoughtsync_desktop_lib` and nothing else.

Now run from the repo root with `--workspace` / `--all`. The lockfile gate keeps
its place on the first cargo invocation.

ci-requirements gains the rule and the reason, plus a note to check a new member
actually appears in the `cargo test` output rather than trusting the green.

Also corrects the lockfile procedure there to `cargo fetch` rather than
`cargo generate-lockfile`: both update the lockfile, but generate re-resolves
from scratch and bumps unrelated crates, turning a two-line manifest edit into
an unreviewable diff. fetch resolves minimally.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.forgejo/workflows/desktop.yml

@@ -77,13 +77,21 @@ jobs:
       # of silently re-resolving. Everything after it in this job then compiles the
       # exact versions recorded in the lockfile, so the flag isn't repeated on the
       # bundle build (issue 2102).
+      #
+      # Run from the REPO ROOT with --workspace, not from desktop/src-tauri.
+      #
+      # These three steps used to run inside the desktop crate, which was right when
+      # it was the only Rust in the repo. After the core was extracted (M12 step 1)
+      # it silently stopped being right: cargo scoped to the desktop PACKAGE, so the
+      # core's 89 tests stopped running and nothing lints the Android uniffi shim at
+      # all. Both crates are dependencies of the desktop, so they still COMPILED —
+      # which is exactly why the gap was invisible, and why a green run kept meaning
+      # less than it looked like it meant.
       - name: Clippy
-        run: cargo clippy --locked --all-targets -- -D warnings
-        working-directory: desktop/src-tauri
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
 
       - name: Test
-        run: cargo test --locked
-        working-directory: desktop/src-tauri
+        run: cargo test --locked --workspace
 
       # Deliberately AFTER clippy + test, not before.
       #
@@ -94,8 +102,7 @@ jobs:
       # means every push reports its real problems too. Still before the ~20-40 min
       # bundle build, so a fmt failure doesn't burn that.
       - name: Rust format check
-        run: cargo fmt --check
-        working-directory: desktop/src-tauri
+        run: cargo fmt --all --check
 
       # Frontend already built above; skip the beforeBuildCommand rebuild.
       #

ci-requirements.md

@@ -85,9 +85,17 @@ backend/frontend push.
   `container.image`; `runs-on: python-ci` is only a scheduling label.
 - **Steps:** build the shared frontend (embedded by `generate_context!`) →
   `cargo tauri icon app-icon.png` (platform icon set from the committed 1024px
-  source) → `cargo fmt --check` → `cargo clippy -D warnings` → `cargo test` →
-  `cargo tauri build` (produces `.deb` + `.AppImage`) → de-bundle the AppImage's
-  graphics libs → verify the `.deb` → repackage for pacman.
+  source) → `cargo clippy --workspace -D warnings` → `cargo test --workspace` →
+  `cargo fmt --all --check` → `cargo tauri build` (produces `.deb` + `.AppImage`)
+  → de-bundle the AppImage's graphics libs → verify the `.deb` → repackage for
+  pacman.
+- **The three analyzer steps run from the REPO ROOT with `--workspace`**, not
+  from `desktop/src-tauri`. Scoping them to the desktop package was correct while
+  it was the only Rust here; after the core was extracted it silently stopped
+  being — the core's 89 tests stopped running, and a fourth crate would not be
+  linted at all. The dependency crates still COMPILE either way, which is exactly
+  why the gap is invisible from a green run. If you add a workspace member, check
+  that it appears in the `cargo test` output before believing the lane covers it.
 - **`APPIMAGE_EXTRACT_AND_RUN=1`** is set: AppImage tooling FUSE-mounts by default
   and CI containers have no `/dev/fuse`.
 - **Packaging tools used from the image** (none installed at job time, rule 5):
@@ -223,9 +231,17 @@ above, and resolution is neither a test run nor a build:
 ```
 docker run --rm --user "$(id -u):$(id -g)" -e CARGO_HOME=/tmp/cargo \
   -v "$PWD:/w" -w /w \
-  git.fabledsword.com/bvandeusen/ci-tauri:1.97 cargo generate-lockfile
+  git.fabledsword.com/bvandeusen/ci-tauri:1.97 cargo fetch
 ```
 
+**`cargo fetch`, not `cargo generate-lockfile`.** Both update the lockfile, but
+generate-lockfile re-resolves the whole graph from scratch and will happily bump
+crates that have nothing to do with your change — turning a two-line manifest
+edit into a few-hundred-line lockfile diff nobody can review. `cargo fetch`
+performs the minimal resolution: existing pins are preserved, only the new
+entries are added. Verify it stayed additive before committing (`git diff
+Cargo.lock | grep '^-'` should show nothing but re-ordered dependency lists).
+
 Resolving inside the CI image rather than against some other cargo is what keeps
 the lockfile format and the picked versions identical to what CI would have
 chosen. Commit the result in the same change as the `Cargo.toml` edit — a