chore: harden CI locking, dedupe majority formula, split demo bundle - #77

Summary

• CI now passes --locked to every cargo build/test/clippy invocation, so a drifted Cargo.lock fails loudly instead of Cargo silently re-resolving to an unreviewed dependency graph.
• Adds a [workspace.lints.rust] warnings = "deny" table so a local cargo build enforces the same bar CI's -D warnings flag does.
• Extracts the (n / 2) + 1 majority-threshold formula, previously duplicated in vote_rotation, cancel_rotation, and resolve, into one Self::majority_threshold helper.
• Adds a CI job for demos/freelance-escrow (install, lint, build), previously uncovered by CI entirely.
• Splits the demo app's Stellar SDK usage into a dynamically-imported chunk, cutting the initial JS bundle from 529KB to 217KB; the SDK-heavy chunk now only loads once a wallet action actually happens.

Findings came from a repo-wide code quality evaluation; these are the mechanical, no-design-judgment items from that list.

Test plan

• cargo fmt --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo test --workspace --locked all pass (67 tests)
• pnpm build and pnpm lint pass in demos/freelance-escrow; build output confirms the bundle split
• No contract behavior change (majority-formula dedup is a pure refactor, already covered by proptest_vote_counting)