Superseded: import the canonical Zed CLI package graph

[ORESoftware]

Summary

This PR replaces the invented zed-lib coordinate with the concrete, separately owned zed-pkg/zed-lock package and makes the graph gate verify that the standalone lock repository is safe before Cargo authority moves.

Changes

• adds zed-pkg/zed-lock = ^0.1.0 beside the existing zed-interfaces and zed-clients Zed edges;
• continues to reject umbrella zed-lib / zed-libs coordinates;
• checks out zed-lock in the package-graph workflow;
• validates the external package identity, repository URL, root Rust target, and crates-io/zed-lock native route;
• rejects a placeholder standalone .zpkg.lock;
• compares the internal and standalone Cargo.toml, license, security policy, source, tests, and examples byte-for-byte;
• retains zed-lock = { path = "crates/zed-lock" } for this PR so package-graph adoption is not mixed with a Cargo source change and lockfile regeneration;
• documents the two-stage migration and explicit merge order.

Intentional merge-order gate

This PR must remain red/draft until zed-pkg/zed-lock#2 is merged. The workflow validates the canonical zed-lock/main, not an unmerged feature branch. After that merge, rerun this PR's failed graph job and merge it to dev only if the full suite is green.

A follow-up PR will pin Cargo to the immutable standalone zed-lock commit, regenerate Cargo.lock, rerun the complete platform and process-contention suites, and then remove crates/zed-lock.

Validation

bash scripts/validate-zed-package-graph.sh \
../zed-interfaces/.zpkg.toml \
../zed-clients/.zpkg.toml \
../zed-lock/.zpkg.toml
cargo test --all-targets --locked

[ORESoftware]

Current main merged #198 while this transition branch was under review. The internal crates/zed-lock workspace member is already removed and Cargo now pins the standalone repository at the original v0.1.0 commit, so this branch's transitional path-edge/source-parity design is no longer the correct merge shape.

The remaining work is now ordered differently:

1. merge zed-pkg/zed-lock#2 as the distinct hardened v0.1.1 package;
2. open a fresh current-main PR that updates the exact Cargo pin and lockfile to the hardened merge commit;
3. add zed-pkg/zed-lock = ^0.1.1 to the CLI Zed dependency graph and validate the canonical repository metadata;
4. keep the already-removed internal crate removed.

Closing this PR as superseded avoids reintroducing the duplicate workspace crate or merging backward from dev.