ci(argo): add CARGO_BUILD_JOBS=30 and --locked to compile-services

Two small but compounding fixes for the compile-services step:

1. CARGO_BUILD_JOBS=30 matches the cgroup limits.cpu="30" set on the
   pod. Without it, cargo asks num_cpus::get_physical() (the host's
   whole CPU count, e.g. 64 on a Scaleway PRO2-XL) and over-subscribes
   vs the cgroup throttle. Expected: ~5-10% better CPU saturation
   under load, fewer context-switch stalls.

2. cargo build --locked skips Cargo.lock resolver work and fails fast
   if the lock has drifted (catches accidental Cargo.toml edits that
   weren't re-resolved). Expected: ~5-15 sec saved per invocation,
   loud error instead of silent re-resolve.

Validation:
- python3 yaml.safe_load_all parses the template cleanly
- cargo check --workspace --release --locked succeeds in foxhunt-brush-test

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

infra/k8s/argo/compile-and-deploy-template.yaml

@@ -197,6 +197,12 @@ spec:
           # so sccache actually catches.  Local dev keeps incremental via config.toml.
           - name: CARGO_INCREMENTAL
             value: "0"
+          # Match the cgroup cpu limit below (limits.cpu: "30").
+          # Without this, cargo asks num_cpus::get_physical() — the host's
+          # whole CPU count — and over-subscribes vs the cgroup throttle,
+          # producing scheduling waste under load.
+          - name: CARGO_BUILD_JOBS
+            value: "30"
           - name: GITLAB_PAT
             valueFrom:
               secretKeyRef:
@@ -283,7 +289,10 @@ spec:
             done
 
             echo "=== Building service binaries: $SERVICE_PKGS (incremental) ==="
-            cargo build --release $CARGO_ARGS
+            # --locked: skip Cargo.lock resolver work (~5-15s saved) and fail fast
+            # if the lock has drifted (catches accidental Cargo.toml edits without
+            # a re-resolve commit).
+            cargo build --locked --release $CARGO_ARGS
 
             # Collect built binaries
             mkdir -p "$WORKSPACE/bin/services"