xtask/pipe: Require lockfile in publish

to avoid errors from invalid dependency versions.

xtask/src/pipelines.rs

@@ -337,7 +337,7 @@ pub fn publish(sh: &Shell, flags: flags::Publish) -> anyhow::Result<()> {
 
                 if let Err(err) = cmd!(
                     sh,
-                    "{cargo} publish {registry...} {more_args...} {dry_run...}"
+                    "{cargo} publish --locked {registry...} {more_args...} {dry_run...}"
                 )
                 .run()
                 .context(err_context)