Fix locked release builds after version bumps

[saulshanabrook]

Summary

Fix the release failure in run 35511336229. The version-bump job changed Cargo.toml from 13.2.0 to 14.0.0 without updating the workspace package entry in Cargo.lock. All seven failed wheel jobs then stopped at Cargo metadata because their --locked builds correctly refused to update the lockfile.

• Install the same SHA-pinned Rust 1.96 toolchain used by CI in the version-bump job.
• Run cargo update --workspace before committing the release branch, updating the local package version while preserving dependency pins. Keep locked wheel builds enabled.
• Skip wheel jobs if release preparation fails or is cancelled; preserve ordinary push/PR wheel builds when the bump job is skipped.
• Add a changelog entry.

Validation

• Reproduced the original lockfile error by running the existing version-bump script in an isolated copy of current main.
• Verified that both offline and normal cargo update --workspace fix the error and allow locked Cargo metadata to succeed. All 234 non-root dependency identities, versions, and sources remain unchanged.
• Existing version/changelog tests: 11 passed.
• Actionlint, applicable pre-commit hooks, and git diff --check: passed.
• make docs: passed with 307 warnings, matching the previously observed main warning count.
• Cross-platform wheel builds will run in this PR's CI; no release was dispatched or published during validation.

Recovering the interrupted release

The failed run already created release PR #426 and version-14.0.0. Its publish and tag/merge jobs were skipped. This PR intentionally leaves that release state untouched.

After merging this fix, close the abandoned release PR and delete its generated branch before dispatching a fresh major release. Otherwise, the next bump will try to push the same branch name. Alternatively, update Cargo.lock on the existing release branch and rerun the failed jobs from the original run. Simply rerunning the failed jobs without repairing that branch will retain the stale lockfile.

[codspeed]

Merging this PR will not alter performance

✅ 14 untouched benchmarks

---

_{Comparing codex/fix-release-lockfile (0e78fe9) with main (f451204)}