[AAASM-2959] 🔧 (release-python): Sync Cargo.lock in pin-ffi-to-tag.sh

[Chisanan232]

Description

Follow-up to #123. The pin-ffi-to-tag.sh helper rewrites the aa-core/aa-proto/aa-sdk-client rev in native/aa-ffi-python/Cargo.toml before each maturin build, but left the sibling Cargo.lock recording the old rev. The wheel only built correctly because maturin doesn't run --locked (cargo silently re-resolves).

This adds a cargo update -p aa-core -p aa-proto -p aa-sdk-client lock-sync at the end of the helper (guarded on cargo + lockfile presence; the maturin build mounts the same checkout, so it uses the synced lock). Keeps the manifest and lock consistent and unblocks hardening the build with --locked later.

Companion fixes in the same AAASM-2959 lock-sync sweep: open pin PRs #121 / #133 (lockfiles synced) and agent-assembly#1049 (bot pin-bump jobs now cargo update).

Type of Change

• 🔧 Configuration / CI change

Breaking Changes

• No

Related Issues

• Refs AAASM-2959

Testing

• No tests required (explain why)

CI-script change; bash -n + shellcheck clean. The lock-sync is verified by the same cargo update flow already applied manually to #121/#133 (which moved the 3 git deps alpha.9→beta.1 cleanly).

Checklist

• Self-review of the diff completed
• Commits follow the Gitmoji convention

[Chisanan232]

Claude Code review — AAASM-2959 (#123 follow-up: sync Cargo.lock in pin-ffi-to-tag.sh)

CI state

Green. MERGEABLE; BLOCKED = required-review only.

Scope vs. acceptance criteria

AC	Status
Helper syncs Cargo.lock after rewriting the manifest rev	✅ appends cargo update --manifest-path "$CARGO_TOML" -p aa-core -p aa-proto -p aa-sdk-client
Guarded so it can't break the build	✅ runs only when cargo + lockfile present; otherwise ::warning and the build re-resolves (no --locked)
Runs on the host checkout maturin mounts	✅ so the synced lock is what the wheel builds against
Minimal; rewrite/verify logic untouched	✅ bash -n + shellcheck clean

Context: #123 (merged) added the pin rewrite but left the lock; this completes it so the manifest + lock agree and the build can be hardened with --locked later. Companion fixes: #121/#133 (lockfiles synced) and agent-assembly#1049 (bot jobs).

Verdict

Ready for approval and merge. Completes the build-time half of the lock-sync.

— Claude Code