fix: install cross with --locked to stop crates.io MSRV drift breaking releases

[abienkowski]

Fixes the Release workflow failure on main (run 34709569942), which failed in both release-rust matrix jobs at the Install cross step.

Root cause

rustc 1.85.1 is not supported by the following packages:
  home@0.5.12 requires rustc 1.88
  textwrap@0.16.3 requires rustc 1.90
Try re-running `cargo install` with `--locked`

cargo install cross without --locked discards the lockfile cross was published with and re-resolves its dependencies to the newest semver-compatible versions on crates.io. Those crates have since raised their MSRV above the 1.85 toolchain pinned in this job.

Nothing changed on our side — crates.io did. The failure is deterministic, not flaky, so re-running the job cannot clear it.

Why CI was green on the PR

workflow	trigger
ci.yml	pull_request only
release.yml	push: branches: [main] only

release.yml cannot run on a pull request, and ci.yml's rust job never invokes cross (the only cargo install cross in the repo is in release.yml). The failing path was structurally unreachable before merge — #31 was green because nothing exercised it.

This also means the breakage was not caused by #31. It would have hit the next release regardless, once those crates published.

Fix

cargo install cross --locked. Verified against the published crate rather than assuming — cross 0.2.5's own Cargo.lock pins:

• home 0.5.3 (not 0.5.12)
• textwrap 0.15.0 (not 0.16.3)

Both comfortably within 1.85, and edition = "2021" needs only 1.56+. --locked removes this step's dependency on current ecosystem state.

Also fixed

targets: → target: on setup-rust-toolchain. The action was rejecting it with Unexpected input(s) 'targets' and silently installing no target. Masked until now because cross compiles inside Docker and does not need the target on the host.

Verification

• release.yml parses as valid YAML.
• Confirmed this was the only unlocked cargo install under .github/.
• Definitive check is this workflow running on merge, since it cannot execute pre-merge.

Follow-ups (not in this PR)

1. release.yml is untestable pre-merge. workflow_dispatch would fix that, but it also makes a workflow that uploads release assets, pushes to GHCR and Cosign-signs manually triggerable — worth a deliberate decision.
2. rust-toolchain.toml lists only x86_64-unknown-linux-musl, no aarch64, which is inconsistent with the new arm64 matrix. Harmless today only because cross builds in containers.