[M5+] cmd_build merges Cargoxx.lock instead of overwriting

CHANGELOG.md

@@ -91,6 +91,13 @@ All notable changes to cargoxx will be documented in this file.
   6 cases against fixtures derived from a real fmt 10.2.1 response;
   `tests/devbox_resolve_live.cpp` (gated by `CARGOXX_NETWORK_TESTS=1`)
   hits the live API.
+- `cargoxx build` now **merges** rather than overwrites
+  `Cargoxx.lock`: when an existing entry's `(name, version)` still
+  matches the manifest, its `nixpkgs_rev` is preserved. New deps and
+  version bumps still get a null rev (track `nixos-unstable`). Means
+  pins written by `cargoxx add <pkg>@<ver>` survive arbitrary
+  rebuilds; cmd_build is now idempotent w.r.t. the lockfile.
+  `synthesize_lockfile` was renamed `merge_lockfile`.
 - `cargoxx.resolver::resolve_version(name, version)` orchestrator
   chains `devbox_resolve` (HTTP, primary) → `nixpkgs_git_resolve`
   (offline, fallback). Returns a 40-char nixpkgs SHA. Wildcards