lock down cargo chef version to stop build errors

[AppleThomas]

No description provided.

[cursor]

PR Summary

Low Risk
Low risk: a single Docker build-step change that only affects dependency installation determinism during image builds.

Overview
Updates cluster/docker/sv-dune.Dockerfile to install cargo-chef with --locked, forcing Cargo to honor the crate’s lockfile and making the build more reproducible (avoids breakages from upstream dependency/metadata changes).

^{Reviewed by Cursor Bugbot for commit afe58c7. Bugbot is set up for automated code reviews on this repo. Configure here.}