Update lockfile spec

[thelovekesh]

• Remove resolved url from lockfile and move to build it dynamically using name + version.
• Add signatures to the lockfile, and remove extra remote call to fetch signatures.

[github-actions]

📦 wpm cli builds 📦

• darwin/amd64 - build
• darwin/arm64 - build
• linux/amd64 - build
• linux/arm/v6 - build
• linux/arm/v7 - build
• linux/arm64 - build
• linux/ppc64le - build
• linux/riscv64 - build
• linux/s390x - build
• windows/amd64 - build
• windows/arm64 - build

[Copilot]

Pull request overview

This PR updates the dependency lockfile format and installation flow to stop storing tarball “resolved” URLs, instead deriving tarball paths from name@version, and to persist package signatures in the lockfile so installs can verify signatures without an extra manifest fetch.

Changes:

• Update wpm.lock package entries: remove resolved, add signatures.
• Propagate signatures through resolution and install planning so the installer can verify without fetching manifests.
• Derive tarball download paths dynamically from package name + version.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/pm/wpmlock/lockfile.go	Updates lockfile package schema to include signatures and drop resolved URLs.
pkg/pm/resolution/resolver.go	Propagates signatures from manifests/lockfile into resolved nodes.
pkg/pm/installer/plan.go	Carries signatures into install/update actions.
pkg/pm/installer/installer.go	Removes manifest fetch for signatures; derives tarball path from name/version.
cli/command/install/run.go	Writes signatures into the lockfile when updating packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.