[ORESoftware]

Summary

Strengthen the Rust package fixture so a crate distributed through Zed retains ordinary Cargo behavior rather than duplicating Cargo metadata in .zpkg.toml.

• bump the fixture to 1.0.1;
• add exact crates.io dependency itoa = 1.0.18;
• add an uppercase Cargo feature;
• exercise the native dependency through the public API;
• keep Zed dependencies and Cargo dependencies in separate manifests;
• certify default and all-feature builds, strict Clippy, Cargo metadata provenance, package contents, and untracked-library-lock behavior;
• expand the Zed publish smoke test to build a separate Cargo consumer with both the Zed path dependency and its own unicode-ident = 1.0.24 registry dependency;
• require locked execution followed by locked/offline replay without creating .zpkg.lock in the Cargo-only consumer.

Interoperability boundary

Zed registry -> materialized rust-lib path -> Cargo resolver
                                              |- itoa (transitive crates.io)
consumer Cargo.toml ---------------------------|- unicode-ident (direct crates.io)

.zpkg.toml identifies Zed packages. Cargo.toml identifies crates.io dependencies and Cargo features. Library source does not track Cargo.lock; the binary consumer owns that exact lock.

Coordination

No open Rust-fixture PR overlapped this work. The existing agent/cargo-dependency-interop branch was present but unchanged from main, so this PR adopts that branch instead of creating a duplicate.

Companion consumer certification: zed-pkg-test/rust-app#3, pinned to this exact head f3c4e33cd0e5726b2c668c0306936f01674261fa.

Native dependency provenance already landed in zed-pkg/zed-interfaces#38 and zed-pkg/zed-cli#175; this PR is an external black-box compatibility fixture rather than duplicate product/schema work.

Tracking: zed-pkg-test/zed-pkg-e2e#113.

Exact-head verification

Package CI is green at f3c4e33cd0e5726b2c668c0306936f01674261fa:

• Cargo/Zed ownership and metadata parity;
• default and all-feature format, strict Clippy, and tests;
• crates.io provenance for itoa 1.0.18;
• Cargo package-content audit;
• external path consumer with direct unicode-ident 1.0.24;
• locked run and locked/offline replay;
• no Cargo lock tracked by the library and no accidental .zpkg.lock creation.

The companion rust-app#3 exact-head suite is also green on Ubuntu, macOS, Windows, and the Docker Zed registry/symlink/copy/offline/dual-lock matrix.

Merge order

Merge this library PR first. If squash merge produces a different reviewed main SHA, advance rust-app#3 from the PR-head pin to that merge SHA and rerun its exact-head matrix before merging the consumer.

No credentials, crates.io publication, or persistent registry write are included.

[ORESoftware]

Companion consumer matrix is now open as zed-pkg-test/rust-app#3, pinned to exact package head f3c4e33cd0e5726b2c668c0306936f01674261fa.

Package CI is green at that head: Cargo/Zed ownership checks, default/all-feature format + strict Clippy + tests, registry provenance, and Cargo package-content audit all passed. Keep this PR draft until the consumer's Linux/macOS/Windows and Docker Zed registry matrix finishes.

[ORESoftware]

Final coordination status: this PR is ready for review at exact head f3c4e33cd0e5726b2c668c0306936f01674261fa.

Its own package CI is green, and companion zed-pkg-test/rust-app#3 is fully green at 0f820e755c9ae806b0d611583b2b57de1869b187 across Ubuntu, macOS, Windows, and the Docker Zed registry/symlink/copy/offline/dual-lock suite.

Merge this PR first. Then advance the consumer's RUST_LIB_REF to the reviewed main merge SHA if it differs, rerun, and merge the consumer only after that final pin passes.

[linear-code]

DEN-2907