fix: Synchronize Cargo prune Docker lockfile (#13350)
## Why
Cargo finalization canonicalizes the complete pruned lockfile, leaving
Docker JSON layers with stale dependency inputs.
## What
Synchronize toolchain-reported finalized files across prune output
layers while keeping finalization nonfatal and single-pass.
## How
Cargo reports `Cargo.lock` after metadata finalization; prune mirrors
those bytes into `json`. Unit and Cargo workspace integration tests
cover nonfatal synchronization, byte equality, locked builds, and
unchanged JS-only prune behavior.
