[M5+] use devbox attr_paths for pinned-dep nixpkgs attr

src/cli/cmd_build.cpp

@@ -75,14 +75,23 @@ auto merge_lockfile(const manifest::Manifest& m,
         const auto& dep = m.dependencies[i];
         const auto& rec = recipes[i];
         std::optional<std::string> rev;
+        // The recipe's nixpkgs_attr is correct for unpinned deps (it's
+        // curated against nixos-unstable). When the prior lockfile
+        // already carries an attr — written by `cargoxx add <pkg>@<v>`
+        // from devbox's authoritative attr_paths for the pinned rev —
+        // that one wins.
+        std::string attr = rec.nixpkgs_attr;
         if (auto p = find_prior(dep.name, dep.version_spec); p) {
             rev = p->nixpkgs_rev;
+            if (p->nixpkgs_attr && !p->nixpkgs_attr->empty()) {
+                attr = *p->nixpkgs_attr;
+            }
         }
         lock.packages.push_back(lockfile::LockfilePackage{
             .name = dep.name,
             .version = dep.version_spec,
             .dependencies = {},
-            .nixpkgs_attr = rec.nixpkgs_attr,
+            .nixpkgs_attr = std::move(attr),
             .nixpkgs_rev = std::move(rev),
             .linkdb_source = rec.source,
         });