ci: build against libfreemkv's dev tip, not its last release

Two things were wrong here.

`cargo test --locked` could never pass. Cargo.lock is gitignored for
this crate (library convention), so there is no committed lockfile to
lock against and cargo refuses to create one — every run failed before
compiling a line. That is the immediate red.

The deeper problem is what the workflow was building against. The
committed Cargo.toml resolves libfreemkv from a git tag, so CI compiled
this branch against the LAST RELEASE of libfreemkv and never against
libfreemkv's dev tip. A change spanning the two repos could not be
verified until release.sh cut the tags — at which point a break is
discovered in the middle of shipping. Green meant "compiles against last
month's library".

Now each repo is checked out into a subdirectory of the workspace,
reproducing the local ~/Developer/freemkv layout, and a generated
.cargo/config.toml redirects the git-tag patch at those paths. That is
the same config-level [patch.crates-io] mechanism local development
already uses, and it wins over the manifest patch. Subdirectories
because actions/checkout refuses a path: outside $GITHUB_WORKSPACE.
Nothing in the manifests or the release cascade changes.

Adds macOS and Windows jobs: this crate ships wherever freemkv and
autorip ship and drags in all of libfreemkv's platform code, and neither
OS was compiling it outside a release build.

clippy gains --all-targets, which is what turned up the manual
str::repeat in keydb_format's round-trip test — test code had never been
linted.

src/keydb_format.rs

@@ -779,11 +779,7 @@ mod tests {
     /// internal key forms (e.g. the `0x`-prefixed disc-hash) match by construction.
     #[test]
     fn to_keydb_cfg_round_trips_through_parse() {
-        let h = |b: u8, n: usize| {
-            std::iter::repeat(format!("{b:02x}"))
-                .take(n)
-                .collect::<String>()
-        };
+        let h = |b: u8, n: usize| format!("{b:02x}").repeat(n);
         let cert = h(0x99, 92); // AACS 1.0 host cert is 92 bytes
         let src = format!(
             "| HC | HOST_PRIV_KEY 0x{priv20} | HOST_CERT 0x{cert} ; Revoked in MKBv72\n\