fix: record and lock Rust release dependencies

[Brooooooklyn]

Release source commits previously omitted Cargo.lock, and CI could resolve newer Rust dependencies when rebuilding the same commit. Track the workspace lockfile and build with --locked so future release commits record the resolved crate versions and dependency drift fails the build.

• Apply --locked to every native build path, including benchmarks, WASI, FreeBSD, and Clippy.
• Forward Cargo arguments through Argon2's custom build script. It previously discarded --locked, leaving Argon2 unprotected even when the workflow supplied it.
• Group Cargo lockfile maintenance separately from Yarn updates, retaining the existing weekly Renovate schedule.
• Remove an unused workflow step referencing the nonexistent matrix.settings.setup field, allowing workflow validation to pass.

This follows canvas #1336. It records dependencies for future releases; it does not reconstruct dependency sets for older binaries.

Validation:

• Built all six native packages on macOS ARM64 through the root Yarn command; verified each Cargo invocation received --locked and the lockfile stayed unchanged.
• Confirmed Argon2 and CRC32 reject a deliberately mismatched lockfile without modifying it.
• Passed locked Cargo metadata resolution, Clippy, TypeScript, lint, formatting, and actionlint.
• Passed renovate-config-validator --strict renovate.json.
• Other platform builds remain for CI.

Fixes #1200.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T03:38:53.663474Z	9f96342	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.