ci: mirror release-workflow strict gates so failed publishes can't slip through

The Release / parity job runs with `--locked` and clippy `-D warnings`.
Main CI ran without either flag, so commits could pass main CI but fail
the release pipeline at the parity stage — which has been silently
blocking every npm publish since v0.4.6 (latest npm = 0.4.8 even though
git tags reach v0.5.2). Most failures were either fmt drift caused by
new stable rustc / rustfmt revisions or lockfile drift the workspace CI
never noticed.

Aligns the Lint job's clippy step with `--locked -- -D warnings` and
the Test job with `--locked` + an explicit `git diff --exit-code --
Cargo.lock` lockfile drift guard. From here on, anything that would
fail Release / parity also fails main CI on the same push, so we
never push a tag we know will fail the publish.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -34,8 +34,12 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Check formatting
         run: cargo fmt --all -- --check
-      - name: Clippy
+      # Mirror the release-workflow `parity` gate exactly. Anything that
-        run: cargo clippy --workspace --all-targets --all-features
+      # would fail there must fail here so we never push a `v*` tag that
+      # the npm publish pipeline can't ship. The Release job runs with
+      # `--locked` + `-D warnings`; we do the same.
+      - name: Clippy (release-strict)
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   test:
     name: Test
@@ -48,7 +52,9 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Run tests
-        run: cargo test --workspace --all-features
+        run: cargo test --workspace --all-features --locked
+      - name: Lockfile drift guard
+        run: git diff --exit-code -- Cargo.lock
       - name: Run Offline Eval Harness
         run: cargo run -p deepseek-tui --all-features -- eval