ci(rust): pass --locked to cargo in Rust CI workflows (#4005)

Cargo silently re-resolves when a Cargo.toml changes without its lockfile
being regenerated. Passing --locked makes CI fail loudly instead.

The cosmwasm and fuel lockfiles were already stale (both still pinned
pythnet-sdk 2.3.1 against a manifest that now declares 3.0.0), so they are
regenerated here.

Co-authored-by: Jayant Krishnamurthy <541339+jayantk@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: jayantk

.github/workflows/ci-cosmwasm-contract.yml

@@ -26,11 +26,11 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy --all-targets -- --deny warnings
+        run: cargo clippy --locked --all-targets -- --deny warnings
         if: success() || failure()
       - name: Build
-        run: cargo build --verbose
+        run: cargo build --locked --verbose
         if: success() || failure()
       - name: Run tests
-        run: cargo test --verbose
+        run: cargo test --locked --verbose
         if: success() || failure()

.github/workflows/ci-fortuna.yml

@@ -21,8 +21,8 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy -p fortuna --all-targets -- --deny warnings
+        run: cargo clippy --locked -p fortuna --all-targets -- --deny warnings
         if: success() || failure()
       - name: Run tests
-        run: cargo test -p fortuna -- --test-threads=1
+        run: cargo test --locked -p fortuna -- --test-threads=1
         if: success() || failure()

.github/workflows/ci-fuel-contract.yml

@@ -32,6 +32,6 @@ jobs:
       - name: Rust add wasm32-unknown-unknown target
         run: rustup target add wasm32-unknown-unknown
       - name: Build
-        run: cargo build --verbose
+        run: cargo build --locked --verbose
       - name: Run tests
-        run: cargo test --verbose
+        run: cargo test --locked --verbose

.github/workflows/ci-hermes-client-rust.yml

@@ -28,8 +28,8 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy -p pyth-hermes-client-rust --all-targets -- --deny warnings
+        run: cargo clippy --locked -p pyth-hermes-client-rust --all-targets -- --deny warnings
         if: success() || failure()
       - name: test
-        run: cargo test -p pyth-hermes-client-rust
+        run: cargo test --locked -p pyth-hermes-client-rust
         if: success() || failure()

.github/workflows/ci-hermes-server.yml

@@ -26,8 +26,8 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy --all-targets -- --deny warnings
+        run: cargo clippy --locked --all-targets -- --deny warnings
         if: success() || failure()
       - name: Run executor tests
-        run: cargo test
+        run: cargo test --locked
         if: success() || failure()

.github/workflows/ci-message-buffer.yml

@@ -69,4 +69,4 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Cargo clippy
-        run: cargo clippy --all-targets -- --deny warnings
+        run: cargo clippy --locked --all-targets -- --deny warnings

.github/workflows/ci-pyth-lazer-pusher.yml

@@ -20,8 +20,8 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy -p pusher-base -p websocket-delivery -p bulk-pusher -p bulk-trade-cli -p bulk-trade-mock-validator --all-targets -- --deny warnings
+        run: cargo clippy --locked -p pusher-base -p websocket-delivery -p bulk-pusher -p bulk-trade-cli -p bulk-trade-mock-validator --all-targets -- --deny warnings
         if: success() || failure()
       - name: Run tests
-        run: cargo test -p pusher-base -p websocket-delivery -p bulk-pusher -p bulk-trade-cli -p bulk-trade-mock-validator
+        run: cargo test --locked -p pusher-base -p websocket-delivery -p bulk-pusher -p bulk-trade-cli -p bulk-trade-mock-validator
         if: success() || failure()

.github/workflows/ci-pythnet-sdk.yml

@@ -20,8 +20,8 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy -p pythnet-sdk --all-targets -- --deny warnings
+        run: cargo clippy --locked -p pythnet-sdk --all-targets -- --deny warnings
         if: success() || failure()
       - name: Run executor tests
-        run: cargo test -p pythnet-sdk
+        run: cargo test --locked -p pythnet-sdk
         if: success() || failure()

.github/workflows/ci-quorum.yml

@@ -20,8 +20,8 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy -p quorum --all-targets -- --deny warnings
+        run: cargo clippy --locked -p quorum --all-targets -- --deny warnings
         if: success() || failure()
       - name: Run executor tests
-        run: cargo test -p quorum
+        run: cargo test --locked -p quorum
         if: success() || failure()

.github/workflows/ci-remote-executor.yml

@@ -27,8 +27,10 @@ jobs:
         run: cargo fmt --all -- --check
         if: success() || failure()
       - name: Clippy check
-        run: cargo clippy --all-targets -- --deny warnings
+        run: cargo clippy --locked --all-targets -- --deny warnings
         if: success() || failure()
       - name: Run executor tests
+        # No --locked: cargo-test-sbf rejects it as an option and routes
+        # anything after `--` to the test binary rather than to cargo.
         run: cargo test-sbf
         if: success() || failure()