Stamp every workspace crate in Cargo.lock (fix v0.21.0 release --locked failure)

[MelbourneDeveloper]

TLDR

Fix the release version-stamper so it stamps every workspace crate in Cargo.lock — the hardcoded crate list omitted deslop-test-support (added in #247) and broke the v0.21.0 release build with cargo build --release --locked.

Details

The release pipeline stamps [workspace.package] version in Cargo.toml to the tag version, then runs cargo build --release --locked. scripts/stamp-release-version.mjs also rewrites the matching Cargo.lock entries — but replaceLockVersions used a hardcoded set {deslop, deslop-core, deslop-lsp, deslop-mcp}. The deslop-test-support crate added by #247 (after v0.20.0) was not in that set, so its Cargo.lock version stayed 0.0.0-dev while Cargo.toml became 0.21.0. --locked then refused to update the lock and the Build job failed in ~8s on every platform (error: cannot update the lock file ... because --locked was passed). v0.21.0 was the first release to include that crate, so it was the first to hit the latent bug.

• scripts/stamp-release-version.mjs: rewrote replaceLockVersions to derive the workspace set from the lock itself — every [[package]] block with no source = line is a workspace/path crate and is stamped. Removed the now-dead hardcoded workspacePackages set. This is drift-proof: a newly added workspace crate can never again silently desync Cargo.lock from the stamped Cargo.toml.

No product code changes; release-infra only. No breaking changes.

How Do The Automated Tests Prove It Works?

• New scripts/test-release-version-stamping.mjs::stamperStampsEveryWorkspaceCrateInLock copies the stamp inputs to a temp dir, runs the stamper, then parses the stamped Cargo.lock and asserts every source-less [[package]] (workspace/path crate) carries the stamped version. Before the fix it failed with workspace crate deslop-test-support left at 0.0.0-dev; after the fix all four stamper tests pass. Because the assertion enumerates source-less crates from the lock rather than a fixed list, it will also catch the next crate addition.
• This test runs in CI via make deployment-verify (Makefile:217), which make ci invokes.
• Verified locally end-to-end: after node scripts/stamp-release-version.mjs 0.21.0, deslop-test-support is stamped to 0.21.0 in Cargo.lock and cargo metadata --locked resolves cleanly (the exact lock-resolution step that failed in the release), then the working tree was restored.