ci: refresh Cargo.lock in release workflow

[ian-pascoe]

Summary

• add a lockfile refresh stage to .github/workflows/release-please.yml that checks out code, sets up stable Rust, runs cargo update --workspace, validates with cargo check --workspace --locked, and conditionally commits only Cargo.lock
• guard Run release-please to avoid self-trigger loops when the workflow-generated lockfile commit is the head commit
• include the cargo-lock release workflow plan documents from the main workspace under .agents/plans/

Test Plan

• rg \"Refresh Cargo.lock|cargo check --workspace --locked|chore\\(lockfile\\): refresh Cargo.lock for release\" .github/workflows/release-please.yml
• rg \"if: .*lockfile.*|if: .*steps\\..*lock_changed\" .github/workflows/release-please.yml
• python3 -m venv /tmp/crosspack-yaml-verify && /tmp/crosspack-yaml-verify/bin/pip install pyyaml && /tmp/crosspack-yaml-verify/bin/python -c \"import yaml; yaml.safe_load(open('.github/workflows/release-please.yml')); print('ok')\"
• rustup run stable cargo test --workspace