Clarify why bins have Cargo.lock but libs don't

Closes #525 

r? @wycats
s/forgot/forget