fix CI: bump Rust 1.82→1.88 (MSRV), fix lockfile check, add xz to opensuse

- Bump RUST_TOOLCHAIN from 1.82 to 1.88 in ci.yml, release.yml,
  supply-chain-test.yml (darling/time crates require 1.88)
- Replace fragile cargo-update+diff lockfile check with cargo check --locked
- Add xz package to opensuse container deps (needed by rustup)

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ env:
     --remap-path-prefix /home/runner/work=src
     --remap-path-prefix /home/runner/.cargo/registry/src=crate
     --remap-path-prefix /home/runner/.rustup=rustup
-  RUST_TOOLCHAIN: "1.82"
+  RUST_TOOLCHAIN: "1.88"
   SOURCE_DATE_EPOCH: "0"
   CARGO_INCREMENTAL: "0"
 
@@ -64,7 +64,7 @@ jobs:
         run: dnf install -y gcc make curl
       - name: Install build deps (openSUSE)
         if: matrix.os == 'opensuse'
-        run: zypper install -y gcc make curl gzip tar
+        run: zypper install -y gcc make curl gzip tar xz
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
@@ -136,7 +136,7 @@ jobs:
             setup: "dnf install -y gcc make curl fuse-overlayfs fuse3 crun"
           - os: opensuse
             container: opensuse/tumbleweed:latest
-            setup: "zypper install -y gcc make curl fuse-overlayfs gzip tar crun"
+            setup: "zypper install -y gcc make curl fuse-overlayfs gzip tar xz crun"
     container: ${{ matrix.container }}
     steps:
       - uses: actions/checkout@v4
@@ -510,14 +510,8 @@ jobs:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
       - name: Verify Cargo.lock is up-to-date
         run: |
-          cp Cargo.lock /tmp/Cargo.lock.before
-          cargo update
-          if ! diff -u /tmp/Cargo.lock.before Cargo.lock; then
-            echo "FATAL: Cargo.lock is not up-to-date or has drifted"
-            echo "Run 'cargo update' locally and commit the result"
-            exit 1
-          fi
-          echo "Cargo.lock integrity: OK (no drift detected)"
+          cargo check --workspace --locked
+          echo "Cargo.lock integrity: OK (lockfile consistent with Cargo.toml)"
 
   cargo-deny:
     name: Dependency Policy (cargo-deny)

.github/workflows/release.yml

@@ -11,7 +11,7 @@ env:
     --remap-path-prefix /home/runner/work=src
     --remap-path-prefix /home/runner/.cargo/registry/src=crate
     --remap-path-prefix /home/runner/.rustup=rustup
-  RUST_TOOLCHAIN: "1.82"
+  RUST_TOOLCHAIN: "1.88"
   SOURCE_DATE_EPOCH: "0"
   CARGO_INCREMENTAL: "0"
 

.github/workflows/supply-chain-test.yml

@@ -13,7 +13,7 @@ env:
     --remap-path-prefix /home/runner/work=src
     --remap-path-prefix /home/runner/.cargo/registry/src=crate
     --remap-path-prefix /home/runner/.rustup=rustup
-  RUST_TOOLCHAIN: "1.82"
+  RUST_TOOLCHAIN: "1.88"
   SOURCE_DATE_EPOCH: "0"
   CARGO_INCREMENTAL: "0"