Cargo.lock isn't updated along with workspace.package.version in releases

What issue are you seeing?

During releasing, workspace.package.version in Cargo.toml is updated to the version number, while Cargo.lock is not[1] [2]. This makes Cargo.lock mismatches with Cargo.toml, and when building/fetching crates with --locked argument, cargo will fail. For example,

# cargo fetch --locked
    Updating crates.io index
error: the lock file /root/new_codex/codex-rust-v0.112.0/codex-rs/Cargo.lock needs to be updated but --locked was passed to prevent this
If you want to try to generate the lock file without accessing the network, remove the --locked flag and use --offline instead.

To ensure reproducibility, distributions often make use of --locked argument[3] to ensure the lock file is the same across different builds. Mismatches between Cargo.lock and Cargo.toml introduce extra maintenance burden for them.

[1]: https://github.com/openai/codex/commit/8c75cd9afcd405d134530e53c78e5e0e4e5312a3#diff-0bdae88bd97e81cd45380b938721a8f794e618c58068084da1fc4e4d52406c3bL73
[2]: https://github.com/openai/codex/commit/0ec16b2d9dd7d92f5661b132afdf4df3abb3d443#diff-0bdae88bd97e81cd45380b938721a8f794e618c58068084da1fc4e4d52406c3bL73
[3]: https://wiki.archlinux.org/title/Rust_package_guidelines#Prepare

What steps can reproduce the bug?

Download the release tarball or checkout to a release tag (similar issues present in both v0.112.0 and v0.111.0), run

cd codex-rs && cargo build --locked  

What is the expected behavior?

Crates are successfully fetched, and no error is reported.

Additional information

_No response_