release: Cargo.lock app version not synced by cz bump (drifts from Cargo.toml)

[winlp4ever]

Summary

The release workflow syncs VERSION, pyproject.toml, webui/package.json, and webui/src-tauri/Cargo.toml (via .cz.toml version_files) during cz bump, and scripts/sync_version.py --check guards those. But webui/src-tauri/Cargo.lock is in neither list, so the app package version in the lockfile drifts from Cargo.toml.

Evidence

• webui/src-tauri/Cargo.lock app version is stale (e.g. 0.3.71) while Cargo.toml is at the bumped version (e.g. 0.3.89).
• release.yml: cz bump (updates the four manifests) → sync_version.py --check (checks only those four). Cargo.lock is not covered.

Impact

At the release tag, the lockfile disagrees with the manifest. The desktop build then either regenerates Cargo.lock (dirty release tree) or fails under cargo build --locked. This undercuts the "all manifests synced at the tag" invariant #242 aimed for.

Suggested fix

Add webui/src-tauri/Cargo.lock to the version-sync + --check set (bump the app entry), or run cargo update -p app --precise <version> (or a plain cargo build) as part of cz bump so the lockfile advances with the manifest.

Found during /code-review high on #250; pre-existing release-tooling gap, unrelated to that PR.