chore: commit Cargo.lock for CI security scanning

[27Bslash6]

Summary

• Removes Cargo.lock from .gitignore
• Commits Cargo.lock for reproducible builds

Why

PyO3 extensions are applications (not libraries), so Cargo.lock should be committed for:

1. Reproducible builds across environments
2. CI security scanning (cargo-audit needs Cargo.lock)

Fixes CI error:

cargo audit --json --file ./Cargo.lock
error: not found: Couldn't load ./Cargo.lock