A lockfile bump should re-key two tasks, not sixty

Out of the box vx folds the lockfile into every key, so `pnpm update` invalidates the world. @vzn/vx-lockfile parses the lockfile and keys each task on its own project's dependency closure. In vx's own repo an astro bump re-keys 6 of 57 tasks, not al