fn build_provenance_warning(provenance: &str) -> Option<String>Expand description
What to warn about provenance, or None when the build came
through the guarded path.
cargo install ignores Cargo.lock unless --locked is passed, so
a hand-rolled install silently resolves dependencies afresh and can
ship a graph no CI run ever tested. That is not hypothetical: it is
how a blocking terminal query reached a user while just check was
green. The remedy belongs in the message because a log line that
only names the problem leaves the reader where that incident
started.