fix(release): keep Cargo.lock synchronized on version bumps

[Teakowa]

What changed

• make the release-tag workflow read the current workspace version with cargo metadata --locked;
• after a workspace version bump, let Cargo synchronize the manifest-derived Cargo.lock state and immediately verify that locked metadata succeeds;
• include Cargo.lock in the automated release version commit.

Why

The direct main commit e89e725 implemented most of #160 (committed Cargo.lock, locked CI/release gates, and benchmark binary reuse), but the release-tag workflow still changed Cargo.toml without updating or staging Cargo.lock. The next automated version bump could therefore create a tag whose release workflow fails under --locked.

Validation

• branch is based on current main after e89e725;
• net diff is limited to .github/workflows/release-tag.yml;
• the workflow first updates lockfile state only when the workspace version actually changes, then verifies cargo metadata --locked before committing.

Fixes #160