ci: keep the cargo-fuzz workspace's crate patches in sync with the root

[ggevay]

Motivation

The :rust: cargo-fuzz job has failed on every Nightly and release-qualification run since 2026-08-28 with build FAILED for src/transform/fuzz: mz-storage-types fails to compile with unresolved imports of TokenProvider, OAuth2TokenProvider, RequestAuthenticator and BearerTokenAuthenticator from iceberg_catalog_rest. Fuzzing has been dark for two releases.

The fuzz crates build in their own workspace, test/cargo-fuzz, which carries a copy of the root's [patch.crates-io] table. Its three iceberg-rust entries were still pinned to the fork revision for 0.9.0 after #38471 moved the root to the 0.10.1 revision. A patch that no longer satisfies the version requirement is not an error to Cargo: it lands in [[patch.unused]] with a warning and the crate resolves from crates.io, which lacks the fork API that #38475 started using two seconds later. The launchdarkly-server-sdk patch in the same table had drifted the same way after the root dropped it in #37026.

Description

• test/cargo-fuzz/Cargo.toml: repin the three iceberg entries to the root's revision and drop the stale LaunchDarkly patch.
• bin/lint-cargo (run by CI's lint step): a new check that fails when the fuzz workspace's patch table carries an entry the root does not have, or one that differs from the root's. It fails on the pre-fix manifest naming all four drifted entries, and passes after. The fuzz workspace may still omit root entries nothing in its graph needs; Cargo warns about those.

Alternatives considered: per-crate fuzz workspaces (more duplication), symlinking or generating the manifest (Cargo has no include mechanism; a generated file for a table that changes a few times a year is not worth the tooling), repinning without the lint (guarantees the same outage on the next root patch bump).

Verification

cargo check passes for src/transform/fuzz and for the whole test/cargo-fuzz workspace (17 crates), resolving iceberg from the fork; cargo metadata shows zero [[patch.unused]] entries. bin/lint-cargo exits 1 on the old manifest and 0 on the new one; black, ruff and pyright are clean. Not run locally: the release build with sanitizer-coverage flags and cargo fuzz build itself. The errors were unresolved imports, which cargo check exercises fully; the Nightly cargo-fuzz step is the end-to-end check.

🤖 Generated with Claude Code