ci: fix native Windows agent build, audit, lockfile; drop redundant test.yml

- Windows agent jobs (build-and-test + release): set PROTOC env + add protoc to PATH
  (prost-build needs it; the runner did not inherit the machine env), and fix the artifact
  path to the workspace-root target/ (Cargo workspace, not agent/target/).
- Commit root Cargo.lock (was missing) -> fixes `cargo audit` (Couldn't load Cargo.lock) and
  makes builds reproducible.
- Security audit is now a single workspace-root `cargo audit`, informational (warn-only) like
  clippy; re-tighten in the GC re-spec.
- Remove test.yml: redundant with build-and-test and broken (`no library targets` — server is
  a binary crate).

Native MSVC agent build verified on the Pluto runner (4m20s, clean compile).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -300,6 +300,8 @@ jobs:
     env:
       CARGO_HOME: C:\Users\Administrator\.cargo
       RUSTUP_HOME: C:\Users\Administrator\.rustup
+      # prost-build (agent build.rs) needs protoc; set explicitly, don't rely on machine-env inherit.
+      PROTOC: C:\protoc\bin\protoc.exe
     steps:
       - name: Checkout the release tag
         uses: actions/checkout@v4
@@ -308,11 +310,12 @@ jobs:
           ref: v${{ needs.version.outputs.version }}
           fetch-depth: 0
 
-      - name: Add cargo bin to PATH
+      - name: Add toolchain dirs to PATH
         shell: pwsh
         run: |
-          # Make cargo/rustc from the Administrator toolchain visible to later steps.
+          # Make cargo/rustc (Administrator toolchain) and protoc visible to later steps.
           "C:\Users\Administrator\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          "C:\protoc\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
       - name: Toolchain sanity check
         shell: pwsh
@@ -333,7 +336,8 @@ jobs:
       - name: Stage unsigned binary
         shell: pwsh
         run: |
-          Copy-Item agent\target\x86_64-pc-windows-msvc\release\guruconnect.exe .\guruconnect.exe
+          # Cargo workspace: binary is in the workspace-root target/, not agent/target/.
+          Copy-Item target\x86_64-pc-windows-msvc\release\guruconnect.exe .\guruconnect.exe
           Get-Item .\guruconnect.exe | Format-List Name, Length
 
       - name: Upload unsigned agent binary