Clarify why bins have Cargo.lock but libs don't

Closes #525