Dependency Verification: What Pinning Buys and What It Does Not

What lock files and hash pinning actually guarantee, how signature and provenance verification differ from it, and where the process fails in practice.