Function lockfile_path 

pub fn lockfile_path(repo_root: &Path) -> PathBuf

Project plugin lockfile (§29): .scc/plugins.lock records the resolved plugin set so behavior reproduces across machines.

Each entry carries id, version, source dir, artifact hash, API version, and granted permissions — the fields lock_entry already emits. Write is atomic (temp + rename); read returns an empty set when absent (fresh checkout, no plugins pinned yet).