build: remove stale Cargo.lock from workspace member test-contract-integration

[sanity]

Problem

Dependabot security-update runs on main fail every time for /tests/test-contract-integration (e.g. run 38584125641 for tracing-subscriber; also time, serde_with; 13 failures since 2026-08-15):

error inheriting `freenet-stdlib` from workspace root manifest ... failed to find a workspace root

Root cause: tests/test-contract-integration/Cargo.lock is a stale leftover from before the crate joined the root workspace (last touched 2025-03-06, #1414). The crate has been a root workspace member using workspace = true deps since #2922 (2026-02-09), so cargo ignores this lockfile and uses the root Cargo.lock (which has tracing-subscriber 0.3.23). But Dependabot's dependency graph reads it, sees tracing-subscriber 0.3.18 / old time / serde_with, raises (false) alerts, and launches a per-directory security job for that unconfigured directory. That job fetches only the crate directory and cannot locate the workspace root (Dependabot's implicit parent walk in find_workspace_root only climbs as many levels as the manifest name has slashes, not the directory depth), so it fails on every run. No other tests/ workspace member has its own lockfile; the standalone fixtures that do have one declare their own [workspace] and are unaffected.

Approach

Delete the dead lockfile. This removes the source of the stale alerts and of the jobs that can never succeed, without touching any dependency or build input. I considered adding package.workspace = "../.." to the member manifests, but with the lockfile gone no per-directory job is started, so it would be unverifiable churn. Real vulnerabilities in the root lock are still covered by the existing / cargo entry.

Testing

• Reproduced the exact error by running cargo metadata on the crate copied alone into a temp dir.
• On this branch: cargo metadata --locked --manifest-path tests/test-contract-integration/Cargo.toml succeeds; cargo check --locked --offline -p test-contract-integration succeeds and no lockfile is regenerated (git status clean). Test contract compilation goes through the workspace target dir (test_utils::compile_contract), so it does not use the per-crate lock.
• Cannot be tested pre-merge: Dependabot only runs on the default branch. Confirm that no new cargo in /tests/test-contract-integration failures appear after merge and the stale alerts auto-close.
• Not addressed here: separate Dependabot glib failures for / and /apps/freenet-ping.

[AI-assisted - Claude]

https://claude.ai/code/session_01TQ6aGBw27ftE4fBPMwNGqV

[sanity]

Light review (independent read; the change was written by a separate agent)

Tier: Light. The change deletes one lockfile and touches no code or workflows.

Verified:

• tests/test-contract-integration is a root workspace member (Cargo.toml:8), so cargo resolves it from the root Cargo.lock and ignores the per-crate one.
• .github/dependabot.yml:209-212 already documents that this crate is covered "through the shared Cargo.lock". The per-crate lockfile contradicts that, and it is what spawns the failing per-directory security job for /tests/test-contract-integration.
• No consumer builds the crate against its own lockfile:
  • test_utils::compile_contract / ensure_contract_compiled and crates/core/tests/{connectivity,operations_before_join}.rs compile it by name through the workspace.
  • netcheck reads it as a path (crates/netcheck/src/main.rs:76).
  • Nothing under .github/ or scripts/ builds it standalone.

Can't be checked pre-merge: whether the Dependabot failure stops. Dependabot runs only on the default branch, so check the next "Dependabot Updates" run after merge.

Out of scope: the glib Dependabot failures for / and /apps/freenet-ping are a separate issue.

Verdict: Ready to merge on green CI.

[AI-assisted - Claude]

[github-actions]

Claude Rule Review: Failed to run

The Claude rule review step failed (likely an authentication or API issue). Check the workflow logs for details.

---

Advisory review against .claude/rules/. Critical patterns are enforced by the Rule Lint CI job.