Cargo.toml claims the pinned nih-plug rev makes builds reproducible, but
the rev only pins that one tree. Everything beneath it — roughly 200
crates.io dependencies — still resolved to whatever was newest at build
time, so two clones a week apart could compile different code.
A cdylib plugin is a final artifact rather than a library others depend
on, so the usual argument for leaving the lockfile out does not apply.
Checking it in also means CI builds exactly what was built locally.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHt4DykxXaQnyaJfyS8KCn
