test(core): harden parity test (config matrix, ground-truth counter assertions) + --locked for release/Docker builds #48

Context

Post-merge review (Claude Sonnet 5.5, 2026-10-15) of #46 and #47 found no blockers, but several hardening opportunities worth tracking.

From the #47 review (parity test)

1. Config matrix: the test only varies engine x optimize. Add coverage for color_mode, hierarchical, filter_speckle, spline preset, optimize preset (crates/core/src/lib.rs:299).
2. Fixture breadth: single 24x18 image emits one translucent group. Add multi-group, a==0 pixels, 1x1 image, Engine::Auto (lib.rs:300).
3. Ground-truth assertions (sharpest gap): parity compares entry points against each other only. Assert streamed.svg_byte_size == sink.len() and path_count == count of b"<path" in the output, so identical simultaneous regression of both counters cannot pass (lib.rs:339).
4. Structural fix option: hand-kept counters next to write_all have drifted once already (test(core): parity test vectorize/vectorize_to + fix PixelExact streaming metadata #47). Consider a counting-writer or count_svg_paths over the emitted buffer so the counter class disappears (pixel_exact.rs:23).

From the #46 review (lockfile)

5. Release workflow & Docker build lack --locked: .github/workflows/release.yml:82 and Dockerfile* cargo builds can resolve different dependencies than CI tested. Add --locked (and ensure the lock is synced first).

Non-goals

No interface/semver changes; SVG output bytes are not touched by any of these.

Ref: audit archive /ops covecto-audit-2026-10-15, PR #46, PR #47.