Expand description
Manifest.lock writer.
The lockfile is itself a Lua return-table (matches the plan’s “default to Lua return-table for consistency” decision in the open questions section). Sha256 maps are emitted with sorted keys so lockfile diffs are stable across re-installs.
Timestamps are intentionally omitted: a lockfile that changes every re-install is noisy in version control and complicates “did anything change?” diffs.