Function resolve_locked_tool 

pub async fn resolve_locked_tool(
    tool: &str,
    platform: ToolPlatform,
    arch: &str,
) -> Result<LockedTool>

Resolve a tool to a fully-pinned LockedTool by live-resolving its exact version + download URL, streaming the artifact to a temp file, and hashing the bytes (verifying against the upstream-published digest when one exists).

This is the resolution path the CLI’s zlayer toolchains lock reuses, so the lock writer never duplicates resolver logic. arch is the keg arch token (arm64 / x86_64); the vendor-arch mapping is internal.

Errors

Propagates resolution / download / digest-verification failures.