fix(build): enforce locked dependency resolution

[reez]

Description

Build and binding-generation commands could silently update the committed Cargo.lock when dependency resolution changed. Add --locked to CI, local recipes, and platform build, bindgen, and documentation scripts so they fail instead of modifying the lockfile.

Notes to the reviewers

Documentation

• bdk_wallet
• bitcoin
• uniffi
• Other:

Changelog

Checklists

All Submissions:

• I've signed all my commits
• I followed the contribution guidelines
• I ran cargo fmt and cargo clippy before committing
• I've added exactly one changelog:* label
• I've linked the relevant upstream docs or specs above

New Features:

• I've added tests for the new feature
• I've added docs for the new feature

Bugfixes:

• This pull request breaks the existing API
• I've added tests to reproduce the issue which are now passing
• I'm linking the issue being fixed by this PR

[thunderbiscuit]

ACK 356817c.

[reez]

Will wait until 3.1.0 fully complete for all downstream etc, then merge this next week hopefully

[j-kon]

ACK 356817c.

Checked the Rust CI, local just recipes, Android build/bindgen scripts, Swift XCFramework scripts, and docs path. The dependency-resolving Cargo commands consistently use --locked, while cargo fmt is correctly left unchanged.

This looks consistent with the goal of failing on lockfile drift instead of silently updating Cargo.lock, without changing the binding/runtime API.