fix(cli-generator): add --locked to cargo commands in emitted CI workflow

[jsklan]

Description

The generated .github/workflows/ci.yml emitted by the CLI generator used bare cargo check/cargo build/cargo test in the check/compile/test jobs, allowing dependency re-resolution against the lockfile. The publish job already used --locked. This aligns all jobs to enforce the committed lockfile, matching what seed.yml does.

Changes Made

• Added --locked to cargo check, cargo build, and cargo test in both constructBuildTestYaml and constructWorkflowYaml in emitPublishWorkflow.ts
• Updated seed snapshot outputs for github-npm and github-no-publish fixtures

Testing

• Unit tests pass (129/129 in generators/cli)
• Seed snapshots updated to reflect the new --locked flag

Link to Devin session: https://app.devin.ai/sessions/acfe2c45830e44e0af353ae6bbf276f5
Requested by: @jsklan

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.