[BUG] Lockfiles not committed → non-reproducible builds; desktop README wrongly claims Cargo.lock is committed

Platform

Repository tooling / CI (affects all platforms — moon ci runs on ubuntu-latest, windows-latest, macos-latest).

Browser

N/A — build reproducibility / repo hygiene.

Current Behavior

No lockfiles are committed on main, so builds are not reproducible:

• Rust: apps/desktop/README.md (line 18) states "The root Cargo.lock is committed." — but it is not. git ls-files tracks no Cargo.lock, and GET /repos/OpenCut-app/OpenCut/contents/Cargo.lock returns 404 on main. So the docs contradict the repo.
• JS: No bun.lock is committed anywhere (apps/web/bun.lock, apps/api/bun.lock both 404 on main).

At the same time, 8 dependencies are pinned to "latest":

apps/web/package.json: @tanstack/react-devtools, @tanstack/react-router,
  @tanstack/react-router-devtools, @tanstack/react-router-ssr-query,
  @tanstack/react-start, @tanstack/devtools-vite
apps/api/package.json: elysia, wrangler

With no committed lockfile, every bun install — locally and in CI on all three OSes — re-resolves these fresh. bunfig.toml's minimumReleaseAge = 604800 only delays picking up a release by 7 days; it does not pin. The moment any latest dependency ships a breaking change (>7 days old), CI and new-contributor setup break with no code change on this side, and two contributors cloning on different days can get different dependency trees.

Expected Behavior

Lockfiles are committed so a clone builds the same way everywhere, matching the README's stated intent:

• Commit the root Cargo.lock.
• Commit apps/web/bun.lock and apps/api/bun.lock.
• (Optional, recommended) replace the "latest" specifiers with the resolved versions so intent is explicit even outside the lockfile.

Recurrence Probability

Always

Steps To Reproduce

1. Clone main.
2. git ls-files | grep -iE 'lock' → no Cargo.lock / bun.lock (or gh api repos/OpenCut-app/OpenCut/contents/Cargo.lock → 404).
3. Read apps/desktop/README.md line 18 — it claims Cargo.lock is committed. Mismatch.
4. Run bun install in apps/web / apps/api; note the "latest" specifiers resolve with no lockfile to pin them.

Anything else?

Fix is ready (commit the three lockfiles; can also pin the latest specifiers if you prefer). Per the PR template / README I'm opening this issue first and requesting maintainer approval before submitting. Related: #839.

Start with apps/desktop/README.md, apps/web/package.json, apps/api/package.json, and bunfig.toml; verify the reported state with git ls-files and bun install in both JavaScript app directories. Done means the root Cargo.lock and both app bun.lock files are committed and the README claim is accurate; review whether the latest dependency specifiers should also be pinned.