fix: use --manifest-path explicitly in cargo update

Pass --manifest-path to `cargo update --workspace` instead of relying
on current_dir + cargo's upward search, matching the pattern used by
cargo_package_file_list in the same file.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ckhordiasma

src/source_distribution/mod.rs

@@ -772,8 +772,10 @@ fn regenerate_cargo_lock(
     // which silently floats third-party pins and breaks reproducibility.
     // `update --workspace` conservatively preserves existing pins while
     // pruning entries for packages no longer reachable from the workspace.
+    let manifest_path = sdist_dir.join("Cargo.toml");
     let mut cmd = Command::new("cargo");
-    cmd.args(["update", "--workspace"]).current_dir(&sdist_dir);
+    cmd.args(["update", "--workspace", "--manifest-path"])
+        .arg(&manifest_path);
     if ctx.project.cargo_options.offline {
         cmd.arg("--offline");
     }