Split a fmt usage error from a fmt verdict across both workspace roots

improvise-b4ks. From the repo root `cargo fmt -p opfs-contract -- --check`
exits 1 with "package `opfs-contract` is not a member of the workspace" and
never runs --check, so a caller reading $? cannot tell "misformatted" from
"nothing was checked". Reproduced at 7cef9f8.

scripts/fmt-workspaces.sh discovers every [workspace] root and checks each
with `-p <member>` scoped by that root's own --manifest-path. Exit 2 is a
usage error or an unrunnable cargo; exit 1 is a formatting verdict.

Both obvious spellings were measured and both fail in the direction that
looks like success: `--all` crosses the boundary, because it formats local
path dependencies and harness/opfs-contract depends on improvise-io by path
(an injected fault in src/draw.rs was reported by the harness root); and the
bare --manifest-path form is blind to workspace members, because the repo
root is a package as well as a workspace (an injected fault in
crates/improvise-core exited 0).

scripts/fmt-workspaces-test.sh is the check_the_checker. Four rivals were
injected and each failed it. Its fixture had to be corrected twice -- a
missing path dependency and a virtual outer manifest -- and both vacuities
were found only by injecting the rival, never by reading.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

.github/workflows/ci.yml

@@ -140,7 +140,10 @@ jobs:
         with:
           components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
-      - run: cargo fmt --all -- --check
+      # NOT `cargo fmt --all`, which reaches only ONE of the two workspace
+      # roots. Exit 2 here is a usage error, never a verdict (improvise-b4ks).
+      - name: Every workspace root is formatted
+        run: ./scripts/fmt-workspaces.sh
       - run: cargo clippy --workspace --all-targets -- -D warnings
       - run: cargo test --workspace
       # The comment cap and the test-evidence keys (improvise-9c8c); without
@@ -275,8 +278,10 @@ jobs:
       # one guard whose absence is invisible until a tag is public and
       # immutable. pr-reviews stands between a merge and an unread review, and
       # was blind to inline comments for as long as it existed (improvise-xgra).
+      # fmt-workspaces is here because its own failure mode is the bug it
+      # exists for: a usage error wearing a formatting failure's exit code.
       - name: The remaining checkers refuse what they claim to
-        run: ./scripts/checkers.sh pr-watch release-preflight pr-reviews
+        run: ./scripts/checkers.sh pr-watch release-preflight pr-reviews fmt-workspaces
 
   # ---------------------------------------------------------------------------
   # Lints the one crate the `test` job cannot reach.