chore(ci): drop the prepare-cli-workspace workaround (#678)

* chore(ci): drop the prepare-cli-workspace workaround

The morphir CLI job rewrote Cargo.toml to exclude morphir-live, deleted
Cargo.lock, regenerated it, and ran `cargo update -p extism`. That
existed to dodge a toml_datetime conflict: morphir-live's dioxus ->
gtk 0.18 -> proc-macro-crate 2.0.2 pinned toml_datetime to exactly
0.6.3, which blocked the extism version the CLI needs.

That conflict was fixed in #677 by moving proc-macro-crate to 2.0.0,
which frees toml_datetime and lets extism resolve to 1.13.0 with
morphir-live still in the workspace. The workaround's final step,
`cargo update -p extism`, was manually forcing the very upgrade the
committed lockfile now encodes.

Removing it also closes a real gap: the job deleted and regenerated
Cargo.lock, so CI never validated the committed lockfile. It does now,
meaning a lockfile regression gets caught instead of silently papered
over.

Verified by running the job's steps against the committed lockfile with
--locked, which fails if the lockfile needs any change:

  cargo fmt --package morphir --check                             exit 0
  cargo clippy --locked --package morphir --all-targets -Dwarnings exit 0
  cargo test --locked --package morphir                            exit 0
  cargo build --locked --release --package morphir                 exit 0

Cargo.lock was unmodified afterwards.

* ci: pass --locked to cargo commands that resolve dependencies

Removing prepare-cli-workspace was supposed to make CI validate the
committed Cargo.lock, but on its own it does not. Without --locked,
cargo silently rewrites the lockfile in the checkout when it is stale
and the job passes against an uncommitted resolution, so a lockfile
regression still slips through.

This is not hypothetical: bumping the morphir-rust submodule in #677
caused a plain `cargo check` to re-resolve nbformat 1.0.0 -> 1.2.2 on
its own, with no prompting.

Add --locked to the commands that resolve dependencies in both the
morphir-live and morphir CLI jobs. cargo fmt does not resolve, so it is
left alone.

Verified locally for the CLI job against the committed lockfile:
clippy, test, and release build all pass with --locked, and Cargo.lock
is unmodified afterwards. The morphir-live job's desktop build needs
GTK system libraries that are unavailable locally, so CI is the check
for that one.

Raised by automated review on #678.

Author: DamianReeves

.config/mise/config.toml

@@ -180,10 +180,6 @@ description = "Add a new submodule under ecosystem/. Usage: mise run submodules:
 run = "python .config/mise/tasks/submodules/add.py"
 
 # ===== CI Tasks =====
-[tasks."ci:prepare-cli-workspace"]
-description = "Prepare Cargo workspace for CLI-only build (excludes morphir-live)"
-run = "python .config/mise/tasks/ci/prepare_cli_workspace.py"
-
 [tasks."ci:validate-docs"]
 description = "Validate documentation files"
 run = "python .config/mise/tasks/ci/validate_docs.py"

.config/mise/tasks/ci/prepare_cli_workspace.py

@@ -74,19 +74,18 @@ jobs:
         run: cargo fmt --package morphir-live --check
 
       - name: Run clippy
-        run: cargo clippy --package morphir-live --all-targets -- -D warnings
+        run: cargo clippy --locked --package morphir-live --all-targets -- -D warnings
 
       - name: Run tests
-        run: cargo test --package morphir-live
+        run: cargo test --locked --package morphir-live
 
       - name: Build (web)
-        run: cargo build --release --package morphir-live
+        run: cargo build --locked --release --package morphir-live
 
       - name: Build (desktop)
-        run: cargo build --release --package morphir-live --features desktop
+        run: cargo build --locked --release --package morphir-live --features desktop
 
   # morphir: CLI tool (depends on extism via morphir-daemon)
-  # Uses separate dependency resolution to avoid conflict with dioxus-desktop
   morphir-cli:
     name: morphir CLI
     runs-on: ubuntu-latest
@@ -105,10 +104,6 @@ jobs:
       - name: Add Rust components
         run: rustup component add rustfmt clippy
 
-      # Generate fresh lockfile without dioxus-desktop to avoid toml_datetime conflict
-      - name: Prepare CLI workspace
-        run: mise run ci:prepare-cli-workspace
-
       - name: Cache cargo
         uses: Swatinem/rust-cache@v2
         with:
@@ -119,13 +114,13 @@ jobs:
         run: cargo fmt --package morphir --check
 
       - name: Run clippy
-        run: cargo clippy --package morphir --all-targets -- -D warnings
+        run: cargo clippy --locked --package morphir --all-targets -- -D warnings
 
       - name: Run tests
-        run: cargo test --package morphir
+        run: cargo test --locked --package morphir
 
       - name: Build
-        run: cargo build --release --package morphir
+        run: cargo build --locked --release --package morphir
 
   # Docs: lightweight job for documentation changes (fast-path)
   # Note: This job intentionally does NOT install mise to stay fast