ci(lazer): pass --locked to cargo in publisher and solana workflows

[jayantk]

What

Adds --locked to the cargo invocations in ci-lazer-publisher.yml and ci-lazer-solana.yml that were missing it:

• ci-lazer-publisher.yml: clippy, test
• ci-lazer-solana.yml: clippy, cargo build-sbf, test

Why

Without --locked, a PR whose Cargo.toml has drifted from its Cargo.lock silently re-resolves dependencies at CI time instead of failing. That defeats the purpose of committing a lockfile — CI can end up green on a dependency set that nobody reviewed, and the same build on a different day can pull different versions. ci-lazer-stellar.yml already did this correctly; these two workflows are now consistent with it.

Note on cargo build-sbf -- --locked

cargo-build-sbf has its own argument parser and rejects --locked as a top-level flag:

error: Found argument '--locked' which wasn't expected, or isn't valid in this context
USAGE:
    cargo-build-sbf [OPTIONS] [-- <cargo_args>...]

Only arguments after -- are forwarded to the inner cargo build, hence the -- separator. Please keep it — "simplifying" it to cargo build-sbf --locked will break the job.

Not changed

The three cargo fmt steps are left alone: cargo fmt does not accept --locked. All cargo install steps already carried the flag.

Verification

Ran every changed command locally against the toolchains the jobs pin, including cargo-build-sbf 4.1.0 / platform-tools v1.54 installed from the same release.anza.xyz/stable installer the workflow uses. All five exit 0, and cargo metadata --locked confirms both lockfiles are already in sync, so no lockfile regeneration was needed.