ci: add reproducible plugin verification

.github/CONTRIBUTING.md

@@ -25,11 +25,11 @@ Thanks for taking the time to contribute! This crate is a WASM plugin for the
 2. Create a feature branch (`git checkout -b feat/your-feature`)
 3. Add a **failing test first** — see existing fixtures in `tests/fixtures/*.html`
 4. Implement the change in `src/parser.rs` / `src/url_matcher.rs` / `src/lib.rs`
-5. Run `cargo test`, `cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`
-6. Build the WASM artefact (`cargo build --target wasm32-wasip1 --release`)
-   and check `wasm_smoke.rs` still passes
-7. Commit using [Conventional Commits](https://www.conventionalcommits.org/)
-8. Push to your fork and open a Pull Request
+5. Run `cargo fmt --all -- --check`, then the locked native and WASM Clippy commands below
+6. Build the WASM artefact with the locked release command below
+7. Run the locked native tests, including the mandatory `wasm_smoke.rs`
+8. Commit using [Conventional Commits](https://www.conventionalcommits.org/)
+9. Push to your fork and open a Pull Request
 
 ### Commit Message Format
 
@@ -54,16 +54,17 @@ rustup target add wasm32-wasip1
 git clone https://github.com/mpiton/vortex-mod-mediafire.git
 cd vortex-mod-mediafire
 
-# Native unit tests + parser fixtures + WASM smoke
-cargo test
-
-# Lint + format
-cargo clippy --all-targets -- -D warnings
-cargo fmt --check
+# Format + lint native and WASM targets
+cargo fmt --all -- --check
+cargo clippy --locked --all-targets --target x86_64-unknown-linux-gnu -- -D warnings
+cargo clippy --locked --lib --target wasm32-wasip1 -- -D warnings
 
 # Build WASM release artefact (1.1 MB)
-cargo build --target wasm32-wasip1 --release
+cargo build --locked --lib --target wasm32-wasip1 --release
 # → target/wasm32-wasip1/release/vortex_mod_mediafire.wasm
+
+# Native unit tests + parser fixtures + WASM smoke
+cargo test --locked --all-targets --target x86_64-unknown-linux-gnu
 ```
 
 ## Adding a fixture

.github/workflows/plugin-ci.yml

@@ -0,0 +1,20 @@
+name: Plugin CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+    tags: ["v*"]
+
+jobs:
+  plugin-ci:
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    permissions:
+      contents: read
+    uses: mpiton/vortex/.github/workflows/plugin-ci.yml@f63e53f866bbdf5e5e3e8f62a37f78e13cec5298
+
+  plugin-release:
+    if: ${{ startsWith(github.ref, 'refs/tags/') && github.actor == github.repository_owner }}
+    permissions:
+      contents: write
+    uses: mpiton/vortex/.github/workflows/plugin-release.yml@d85baa93ac7905c5813095b2406f2a3642458356