Lock resolved tool versions and artifact checksums for reproducible installations.