Model Marketplaces Need Lockfiles

If the manifest says claude-3-5-sonnet-20240620, the regression suite calls that exact model — not an alias that silently floats to whatever’s newest.