What is Package.resolved, when does it change, and how do you make CI resolve exactly what developers tested?

Predict first

What does each command build after upstream publishes 1.1.0?

// === run.sh ===
export GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@t GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@t
W=$(mktemp -d); cd $W
mkdir -p Lib/Sources/Lib && cd Lib && git init -q -b main
cat > Package.swift <<'E'
// swift-tools-version: 6.0
import PackageDescription
let package = Package(name: "Lib", products: [.library(name: "Lib", targets: ["Lib"])], targets: [.target(name: "Lib")])
E
echo 'public let v = "1.0.0"' > Sources/Lib/V.swift; git add -A; git commit -qm 1; git tag 1.0.0
echo 'public let v = "1.1.0"' > Sources/Lib/V.swift; git commit -qam 2
cd ..; mkdir -p App/Sources/App; cd App
cat > Package.swift <<E
// swift-tools-version: 6.0
import PackageDescription
let package = Package(name: "App", dependencies: [.package(url: "file://$W/Lib", from: "1.0.0")],
  targets: [.executableTarget(name: "App", dependencies: [.product(name: "Lib", package: "Lib")])])
E
printf 'import Lib\nprint("Lib", v)\n' > Sources/App/main.swift
echo "first build:            $(swift run 2>&1 | tail -1)"
(cd ../Lib; git tag 1.1.0)
echo "after 1.1.0 is tagged:  $(swift run 2>&1 | tail -1)"
swift package resolve --force-resolved-versions >/dev/null 2>&1
echo "force-resolved:         $(swift run 2>&1 | tail -1)"
swift package update >/dev/null 2>&1
echo "after package update:   $(swift run 2>&1 | tail -1)"
echo "pinned version now:     $(grep -o '"version" : "[^"]*"' Package.resolved | tail -1)"

• 1.0.0 on a plain build and after force-resolved; 1.1.0 only after swift package update, and the pin changes
• 1.1.0 on the very next build
• force-resolved moves to 1.1.0