The create-release workflow bumps version in Cargo.toml but didn't
regenerate Cargo.lock, causing --locked builds to fail. Added
cargo generate-lockfile step and Cargo.lock to the commit.