libfreemkv is a library — Cargo.lock is gitignored (standard for libs). --locked refuses to create a lockfile on a fresh runner, so it always fails CI. --locked stays in the binary crates (freemkv, autorip, bdemu) which DO track Cargo.lock and benefit from the dependency-race hard-fail behaviour.