Measure the size budget on a copy, not on the canary itself

[samoylenkodmitry]

The bug

just size-budget (and so just budgets) rewrote the tracked
apps/isolated-demo/Cargo.lock on every run, leaving the working tree dirty.

The gate passes cargo a patch.crates-io.<pkg>.path for all 18 Cranpose crates
while pointing it at apps/isolated-demo/Cargo.toml. Cargo re-resolves under
those patches and strips source and checksum from every Cranpose entry.

Confirmed by removal — no build needed, the resolve alone does it:

cargo metadata --format-version 1 --manifest-path apps/isolated-demo/Cargo.toml --config "patch.crates-io.cranpose.path=\"$PWD/crates/cranpose\""

apps/isolated-demo is the canary proving a release is consumable from
crates.io. A developer running the gate and committing the result would have
quietly converted it to a path build that verifies nothing.

The fix

A patched build now compiles a staged mirror under target/patched-packages/,
where the rewritten lockfile is a build artifact like any other.

• What gets mirrored is derived, not hardcoded. cargo metadata --no-deps
  (which does not touch the lockfile) reports the package's target src_paths;
  staging copies the manifest, the lockfile and those directories. Copying the
  package wholesale would drag in android/app/build, ios/build, pkg.
• The mirror is content-diffed, not re-copied. Restamping mtimes would force
  a full fat-LTO rebuild every run. A no-op re-run now takes 0.17s.
• dist-min takes the same --manifest-path + --patch-workspace-cranpose
  pair and routes through the same staging.

Regression test first

The invariant being destroyed is "the canary lockfile references published
crates", so it is now the just versions gate: every Cranpose crate in
apps/isolated-demo/Cargo.lock must resolve from crates.io with a checksum. I
verified it goes red on the mutated lockfile and green on the clean one before
touching xtask. Five xtask unit tests cover staging end-to-end, incrementality,
pruning, the two no-staging paths, and the outside-the-package rejection.

Verification

git status --porcelain stays empty through both:

gate	result
just size-budget	exit 0 — 9411184 bytes (8.98 MiB), built from the staged copy
just test / clippy / fmt-check / versions / typos / doc	pass, zero warnings

Note for the reviewer

The second commit (Give the non-UTF8 toggle fixture a path the tmpfs gate allows) fixes a test that is red at main's tip from a1f64e5. PRs #503,
#506 and #507 each fix that same one line differently. It is a separate commit
here so it drops cleanly once any of them lands — say the word and I will
remove it.

just dep-budget fails on macOS hosts on duplicate objc2* families,
reproducible on a pristine main; that is #507's subject, not this PR's.

🤖 Generated with Claude Code