Restore the harness-lock network step the recompose dropped

improvise-dndu, from #245's review and Codex. Resolving the ci.yml
conflict with `git checkout --theirs` took #228's whole file, not the
conflicting hunk, so #245's `test`-job step running
`check-harness-lock.sh --allow-network` against the real harness lock
went with it. `git diff 1bec7c0f f41a946b -- ci.yml` was empty: CI kept
only the kb row's self-test, which never reads the real lock. The merge
message's "the --allow-network step is unchanged" was wrong; this
supersedes it.

The four lines are restored after the fmt step, where #245 had them.
The evidence note records that the self-test and the network step are
two different checks, and how to verify a conflict resolution against
each parent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze

.github/workflows/ci.yml

@@ -144,6 +144,10 @@ jobs:
       # roots. Exit 2 here is a usage error, never a verdict (improvise-b4ks).
       - name: Every workspace root is formatted
         run: ./scripts/fmt-workspaces.sh
+      # A manifest-only change to a crate the harness reaches by path stales
+      # its own lock, which only the slow `build` job saw (improvise-zs2r).
+      - name: The harness lock matches the manifests it resolves against
+        run: ./scripts/check-harness-lock.sh --allow-network
       - run: cargo clippy --workspace --all-targets -- -D warnings
       - run: cargo test --workspace
       # The comment cap and the test-evidence keys (improvise-9c8c); without