--locked checks need to be the first step in the job

[epage]

See

azure-pipelines/azure/cargo-check.yml

Line 36 in db26ae1

# we only check with --all here since we don't care about the actual

With the --locked check being at the end, cargo will have already re-evaluated the lock file, making it never fail.