Function write_lockfile 

fn write_lockfile(
    deploy: &DeployManifest,
    cache_root: &Path,
    manifest_dir: &Path,
)

Write rbnx-boot/deployment.lock: what this run actually used.

Shaped after the lockfiles that had to solve this already. From flake.lock, the split between what was asked for and what it resolved to: a branch is the request, a commit is the answer, and conflating them is the bug this file exists to expose. From Cargo.lock and package-lock.json, a format version, so the file can change without a reader guessing. From all three, determinism: entries sorted, no timestamp, so the file changes when the deployment changes and not when it merely ran again — a lock that rewrites itself on every boot is one nobody reads a diff of.

Written, not enforced. A deployment was found three commits behind its branch with uncommitted edits on top and no artifact of the run said so. This is that artifact; refusing to boot on a moved branch is a separate decision that needs a fetch and a policy.