Solana 1.x + 2.x crates in one graph fail on zeroize; test with generate-lockfile

If any dependency still pulls solana-program 1.x (e.g. a crate built for anchor-lang 0.30) into a graph that also has Solana 2.x crates (anchor-spl 0.31 -> spl-pod 0.5 -> solana-zk-sdk 2.1), resolution fails. curve25519-dalek 3.2.1 under solana-program 1.18 requires zeroize >=1,<1.4, and curve25519-dalek 4 under zk-sdk needs zeroize ^1.7, while cargo allows one 1.x copy. Depending on index and lock state, the error names zeroize, solana-program or solana-atomic-u64, so don't chase the named crate. Find the 1.x puller with cargo tree -i zeroize@1.3.0, then bump it (here mpl-core >= 0.11 declares anchor-lang ^0.31.1). To test candidate version sets fast, rustup-init -y --profile minimal into a temp RUSTUP_HOME/CARGO_HOME and run cargo generate-lockfile: it only resolves, so each try takes seconds and needs no Solana platform-tools.