[Bug]: Changing a package version keeps the old package version in the `devbox.lock` file

[savil]

Current Behavior (bug)

if I change devbox.json from go@1.19 to go@1.20, and do devbox install, I still see the go@1.19 in the devbox.lock (in addition to the new go@1.20)

Expected Behavior (fix)
Changing a package version should drop the old package version from devbox.lock file

[mikeland73]

@savil should we have a lock.MakeTidy() or similar that eliminates excess entries? Would help when modifying devbox.json manually etc.

[savil]

@mikeland86 ooh I like that. I could work on it.

Would help when modifying devbox.json manually etc.

if I modify a devbox.json manually, and then do devbox shellenv, then because the devbox.json has changed the local.lock cache will be busted. So, then ensurePackagesAreInstalled would run and we should call lock.makeTidy() within it.