Cargo.lock for reproducible builds

Cargo generates Cargo.lock to pin exact dependency versions. For binaries, commit the lock file so everyone builds the same dependencies. For libraries, don't commit it (users should resolve their own). The lock file enables reproducible builds: cargo build uses the locked versions, and cargo update refreshes them. I commit Cargo.lock for applications, Docker images, and CI pipelines. For security, cargo audit checks locked dependencies for known vulnerabilities. Dependabot or Renovate can auto-update dependencies via PRs. The lock file is also useful for rollback: checking out an old commit rebuilds with the old dependencies. This is critical for production stability and debugging.