chore: integrate hardened zed-lock v0.1.1 package

[ORESoftware]

Summary

• advances the external Cargo dependency to the merged, hardened zed-lock v0.1.1 package at immutable commit a0dc78d385bc3ab553d3027b427f5f1428239c9c;
• adds the matching zed-pkg/zed-lock@^0.1.1 Zed package edge;
• preserves removal of the duplicate in-tree crates/zed-lock source;
• validates the canonical interfaces, clients, and lock-package graph through exact sibling manifests; and
• documents the shared Cargo/Zed ownership model.

Exact current-main composition

Current review head:

a80ff1635fcfbb4049fa853c3eb966197d2d33ca

The branch is based on current main commit 20567e717447c85c286cdf43dfefa2db83d2883c, including the terminal-green Nix fixed-output operation-lock repair and the frozen-rendezvous canary correction. The package integration no longer depends on a known failing repository-wide test.

Published release evidence

The immutable v0.1.1 release targets exactly a0dc78d385bc3ab553d3027b427f5f1428239c9c and contains:

• zed-lock-0.1.1.crate — release asset digest sha256:ccb609710619dac7e80620a63b8f006c039602d36e543482e48c62a46205a6ac;
• zed-lock-0.1.1.crate.sha256 — release asset digest sha256:5432f2312977033df6282ac57070b70c1b29f269903d273280e54210bb287771.

The fully green Linux/macOS/Windows review matrix also retains Actions artifact 8942659707, named zed-lock-0.1.1-42332da9abbf9638ea3a1f34eb225cf90900bbac, with ZIP digest sha256:1bb3235b54975054502823d734ed90fa2e0b78ead1f1a53c92829d4fc1db28ce.

No existing release tag was overwritten and no crates.io publication is claimed.

Resolver-owned lock update

A branch-scoped workflow ran cargo update -p zed-lock, asserted the exact v0.1.1 Git source, compiled all targets with --locked, committed only Cargo's generated lock delta, and removed itself. The review branch contains no write-enabled materializer workflow.

Merge criteria

The exact-head repository matrix must be terminal-successful, including:

• package-graph validation;
• standalone locked install;
• frozen lock integrity;
• global-profile and manifestless lifecycle;
• Linux/macOS/Windows CI and strict Clippy;
• Nix fetch/export/fixed-output checks;
• OCI/copy-mode behavior; and
• policy, hardening, help/completion, and polyglot gates.

Superseded PR salvage

Supersedes: yes

• Predecessor: Pin Cargo and the Zed package graph to hardened zed-lock v0.1.1 #204
• Salvaged: standalone zed-lock dependency extraction and removal of the duplicate in-tree crate
• Incorporated at: Cargo.toml, Cargo.lock, .zpkg.toml, package-graph validation, and package dependency documentation in this PR

[linear-code]

DEN-2498