Build the QA tools against the deps they were published with

[pathscale]

The suite has not been running

Install native QA tools fails, and every step after it is skipped, not
failed:

8.  Install native QA tools: failure
9.  Install Dependencies:    skipped
10. Lint:                    skipped
11. Contract Check:          skipped
12. Type Check:              skipped
13. Build:                   skipped
14. Rendered component outcomes: skipped
15. API Contract:            skipped
16. Consumer Smoke:          skipped
17. Package Check:           skipped

This is true on master, not only on pull requests. A run shows one red step
and nothing else, so it reads like an infrastructure hiccup rather than what it
is: the library's entire verification has been inert.

Cause

cargo install ps-qa qa-inspect-host resolves fresh every run, picking the
newest ps-blitz-* that satisfies each requirement. Those crates are not
compatible across minor versions, so qa-inspect-host was compiled against
ps-blitz-script 0.4.1 while its tauri-runtime-blitz expected 0.3.x:

expected `blitz_script::document::ScriptDocument`, found `ScriptDocument`
expected `blitz_traits::node_id::NodeId`, found `NodeId`

Same type name, two crate versions, so every call between them fails to
typecheck. Nothing in this repository changed to cause it — the resolution
drifted underneath.

Fix

--locked, so each tool builds against its own published lockfile: the set its
author tested.

The previous comment said not to inherit a tool crate's lockfile, to keep the
harness current. That intent is preserved — both tools still install at their
newest published version, ps-qa 0.5.11 and qa-inspect-host 0.1.8. Only
their transitive ps-blitz-* pins change, to the ones that actually compile.

One command per tool is deliberate: cargo install a b --locked resolves the
pair together and downgrades to satisfy both, landing on qa-inspect-host
0.1.4. Installed separately, each keeps its own resolution and stays current.

Verified locally

Both forms were run into a scratch --root, not against the checkout:

command	result
cargo install ps-qa qa-inspect-host (current)	fails, the type mismatch above
cargo install ps-qa qa-inspect-host --locked	builds, but downgrades to qa-inspect-host 0.1.4
cargo install ps-qa --locked then cargo install qa-inspect-host --locked	builds, 0.5.11 and 0.1.8

The last is what this PR ships. CI on this branch is the real check: the steps
below the install should run for the first time in a while, and may surface
findings that have been accumulating unseen.

[pathscale]

Landed on master as 300441e via rebase + fast-forward. The rebase rewrote the SHA, so GitHub could not detect it automatically — closing explicitly.

CI on this branch went green end to end before merging: Install native QA tools succeeded, and every step it had been skipping ran and passed — Lint, Contract Check, Type Check, Build, Rendered component outcomes, API Contract, Consumer Smoke, Package Check. Nothing had rotted behind the broken step.