Function verify_lock 

pub fn verify_lock(u: &PackageUniverse) -> Vec<Diag>

fail-closed verification: missing entry, version drift, or hash mismatch stops resolution — never a silent re-resolve