fix(ci): address AI review — rustup idempotency and cargo --locked

Dockerfiles:
- Merge rustup target add and component add into one chained RUN with
  || true guard, making it safe if rustfmt/clippy are already present
  in the base image's default toolchain profile (rust:1.88-slim default
  profile includes both; the guard is belt-and-suspenders)

test.yml:
- Add --locked to cargo clippy and cargo test to enforce Cargo.lock
  during CI, preventing silent dependency upgrades

Not addressed (accepted/out of scope):
- git in images: already installed in all three Dockerfiles (lines 19,
  13, 15 respectively) — reviewer finding was incorrect
- HTTP registry: accepted risk for air-gapped self-hosted infrastructure
- Image signing (Cosign): no infrastructure in place yet
- Hardcoded registry IP: consistent with project-wide pattern

.docker/Dockerfile.linux-amd64

@@ -21,5 +21,5 @@ RUN apt-get update -qq \
     && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-RUN rustup target add x86_64-unknown-linux-gnu
-RUN rustup component add rustfmt clippy
+RUN rustup target add x86_64-unknown-linux-gnu \
+    && rustup component add rustfmt clippy || true

.docker/Dockerfile.linux-arm64

@@ -41,6 +41,6 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     --default-toolchain 1.88.0 --profile minimal --no-modify-path \
     && /root/.cargo/bin/rustup target add aarch64-unknown-linux-gnu \
-    && /root/.cargo/bin/rustup component add rustfmt clippy
+    && (/root/.cargo/bin/rustup component add rustfmt clippy || true)
 
 ENV PATH="/root/.cargo/bin:${PATH}"

.gitea/workflows/test.yml

@@ -72,7 +72,7 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
-      - run: cargo clippy --manifest-path src-tauri/Cargo.toml -- -D warnings
+      - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml -- -D warnings
 
   rust-tests:
     runs-on: ubuntu-latest
@@ -107,7 +107,7 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
-      - run: cargo test --manifest-path src-tauri/Cargo.toml -- --test-threads=1
+      - run: cargo test --locked --manifest-path src-tauri/Cargo.toml -- --test-threads=1
 
   frontend-typecheck:
     runs-on: ubuntu-latest