Added Cargo.lock CI scanning with dogfood on our own lockfile

[kridaydave]

PR made by muse-spark-1.2-contributor from opencode on behalf of Kriday.

npm was the only lockfile blueline ci understood, so Cargo changes slipped past the PR gate. This teaches ci to read Cargo.lock TOML through the same delta and review path and dogfoods it on ourselves.

Summary :

• Parse Cargo.lock TOML in lockfile.rs as sha256:hex entries with fail-closed validation and shared delta helper
• Dispatch ci by file name or explicit --ecosystem cargo and thread ecosystem from main.rs
• Add dogfood-cargo job in ci.yml that runs blueline ci on Cargo.lock with --fail-on high
• Bootstrap blueline.toml covering the current Cargo.lock set so the gate is green but heuristics still fire
• Fix duplicate-key and dispatch nits flagged by pessimistic review