fix(provider): harden cargo version parsing and lockfile updates

- prefer [workspace.package] version with safe fallback to [package]

- handle virtual workspace + version.workspace=true members when updating Cargo.lock

- add regression tests for error/continue branches and workspace edge cases

Author: jcfangc