ci: build the development scripts' mado with --locked

[akiomik]

Finishes what #410 and #411 did for CI, on the side a contributor runs.

scripts/acceptance/test.sh builds and runs mado to compare it against mdl, and
scripts/benchmarks/comparison.sh builds it to time. Both did so unlocked, so
either one can rewrite the tracked Cargo.lock under someone who only meant to
measure something.

The measurement is the better reason. Both scripts answer a question about this
tree — what mado reports, and how long it takes — and a build that resolves a
newer dependency answers it about a different one.

scripts/acceptance/test.sh:124        cargo build              -> cargo build --locked
scripts/acceptance/test.sh:168        cargo run --             -> cargo run --locked --
scripts/benchmarks/comparison.sh:92   cargo build --release    -> cargo build --locked --release

Left alone

just flamegraph and just fuzz, which are the two invocations this leaves.
Neither can be given the flag:

• cargo flamegraph has no --locked, --frozen or --offline of its own and
  no passthrough to cargo's; its trailing arguments go to the binary being
  profiled.
• cargo fuzz run has none of the three either; its trailing arguments go to
  libFuzzer. It resolves and can rewrite fuzz/Cargo.lock, which is tracked, so
  it is the same failure this pull request closes rather than a different one.

Both need something other than a flag — CARGO_NET_OFFLINE around the recipe,
or a cargo build --locked ahead of it — and that is not a --locked change.

Verification

• Each command run as the scripts now spell it: cargo build --locked,
  cargo run --locked -- --config … check … and cargo build --locked --release
  all succeed against the tracked lockfile. The middle one matters most, the
  flag having to sit before the -- that hands the rest to mado.
• sh -n and dash -n pass on both scripts.
• shellcheck reports what it reported before the change: the four SC2016 in
  comparison.sh that The benchmark scripts are unquoted, and nothing runs shellcheck on them #398 covers, and nothing new.

No changelog entry: the development scripts are not something a user of mado
can observe, which is what CONTRIBUTING.md asks the entry to describe.

🤖 Generated with Claude Code

https://claude.ai/code/session_011xqGos7Q8MiBm6G59sh4FV

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.81%. Comparing base (fb5e57a) to head (d0d290d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #412   +/-   ##
=======================================
  Coverage   99.81%   99.81%           
=======================================
  Files          72       72           
  Lines        8527     8527           
=======================================
  Hits         8511     8511           
  Misses         16       16           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.