[sgl-router] Prepare dynamo-render dependencies (#39457)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/pr-test-sgl-router.yml

@@ -102,38 +102,12 @@ jobs:
       # of self-hosted-runner pip installs that compile Rust extensions.
       RUSTC_WRAPPER: sccache
       SCCACHE_GHA_ENABLED: "true"
-      # Supply-chain guard: deny.toml allowlists the dynamo git source but
-      # cannot pin a SHA. Bumps to this constant must be a deliberate PR.
-      DYNAMO_TOKENIZERS_EXPECTED_REV: "1efdd4dcb901caeae636131321094090d252c8d6"
     steps:
       - uses: actions/checkout@v4
 
       - name: Install protoc
         run: sudo bash scripts/ci/utils/install_protoc.sh
 
-      - name: Verify dynamo-* SHA pin
-        run: |
-          set -euo pipefail
-          revs=$(grep -E '^dynamo-[a-z]+[[:space:]]*=.*\brev[[:space:]]*=' experimental/sgl-router/Cargo.toml \
-            | sed -E 's/.*rev[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/')
-          if [ -z "${revs:-}" ]; then
-            echo "::error::no dynamo-* git deps with rev= found in experimental/sgl-router/Cargo.toml"
-            exit 1
-          fi
-          count=0
-          while IFS= read -r r; do
-            count=$((count + 1))
-            if [ "$r" != "$DYNAMO_TOKENIZERS_EXPECTED_REV" ]; then
-              echo "::error::dynamo-* SHA pin mismatch in experimental/sgl-router/Cargo.toml"
-              echo "  expected: $DYNAMO_TOKENIZERS_EXPECTED_REV"
-              echo "  actual:   $r"
-              echo "All revs found:"
-              echo "$revs" | sed 's/^/  /'
-              exit 1
-            fi
-          done <<< "$revs"
-          echo "dynamo-* SHA pin OK: $count entries all at $DYNAMO_TOKENIZERS_EXPECTED_REV"
-
       # sccache install is best-effort: the GitHub release CDN intermittently
       # returns 5xx and the action's built-in retry is shallow. If it fails,
       # we unset RUSTC_WRAPPER below and proceed without compile caching —
@@ -163,11 +137,11 @@ jobs:
 
       - name: cargo check
         working-directory: experimental/sgl-router
-        run: cargo check --workspace --all-targets
+        run: cargo check --locked --workspace --all-targets
 
       - name: cargo clippy
         working-directory: experimental/sgl-router
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
 
       - name: cargo fmt
         working-directory: experimental/sgl-router
@@ -238,7 +212,7 @@ jobs:
         working-directory: experimental/sgl-router
         run: |
           START=$(date +%s)
-          cargo build --release --all-targets
+          cargo build --locked --release --all-targets
           END=$(date +%s)
           BUILD_SECONDS=$((END - START))
           echo "tier_2_build_duration_seconds=${BUILD_SECONDS}" >> "$GITHUB_ENV"
@@ -252,7 +226,7 @@ jobs:
         # the Qwen3-0.6B tokenizer.json. Filter is matched against the
         # full test path `tokenizer::parity::parity_matrix`; substring
         # `parity_matrix` is unique to that test.
-        run: cargo test --release --workspace -- --skip parity_matrix
+        run: cargo test --locked --release --workspace -- --skip parity_matrix
 
       # Regenerate the cross-impl block-hash parity fixture and fail if it
       # differs from the committed file.  The Python script replicates
@@ -372,7 +346,7 @@ jobs:
         working-directory: experimental/sgl-router
         run: |
           source "$HOME/.cargo/env"
-          cargo build --release --workspace
+          cargo build --locked --release --workspace
 
       # Install SGLang from the local checkout in editable mode (no PyPI
       # version pin) — mirrors `pr-test-rust.yml` so the router e2e runs
@@ -411,7 +385,7 @@ jobs:
           HF_TOKEN: ${{ secrets.HF_TOKEN }}
         run: |
           source "$HOME/.cargo/env"
-          cargo test --release --test component tokenizer::parity
+          cargo test --locked --release --test component tokenizer::parity
 
   sgl-router-finish:
     name: finish