Function update 

pub async fn update(
    client: &RegistryClient,
    dir: &Path,
    lock_path: &Path,
    apply: bool,
    force: bool,
) -> Result<UpdateReport>

Re-resolve every lockfile entry. With apply, download and rewrite changed artifacts (overwriting their own files) and update the lockfile.

An artifact whose installed files no longer match the lockfile is reported and left alone unless force. This matters most for the targets that write to a fixed project path — codex owns AGENTS.md and copilot owns .github/copilot-instructions.md — where an overwrite would take a file the project also edits by hand.