fix: add --locked flag to cargo install cargo-llvm-cov in coverage.sh

Without --locked, cargo resolves the newest compatible versions of all
transitive dependencies at install time, which can produce different
binaries across runs and pull in unreviewed dependency updates.
The --locked flag forces cargo to use the dependency versions pinned
in cargo-llvm-cov's own Cargo.lock, making the install reproducible.

Author: xiaolai

.changeset/fix-pin-cargo-llvm-cov.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Add --locked flag to cargo install cargo-llvm-cov in coverage.sh for reproducible installs

scripts/coverage.sh

@@ -18,7 +18,7 @@ set -euo pipefail
 # Check if cargo-llvm-cov is installed
 if ! cargo llvm-cov --version &> /dev/null; then
   echo "cargo-llvm-cov is not installed. Installing..."
-  cargo install cargo-llvm-cov
+  cargo install --locked cargo-llvm-cov
 fi
 
 # Run coverage and generate HTML report