How do you make Swift Package dependencies reproducible on CI: what Package.resolved pins, when versions move, and what the force-resolved flag does?

Predict first

A dependency is tagged 1.1.0 after the lockfile pinned 1.0.0. Which commands move it, and what does force-resolved do after a manifest change?

// === run.sh ===
export GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@x GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@x GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null
W=$PWD; mkdir -p Lib/Sources/Lib App/Sources/App
cat > Lib/Package.swift <<'EOT'
// swift-tools-version: 6.0
import PackageDescription
let package = Package(name: "Lib", products: [.library(name: "Lib", targets: ["Lib"])], targets: [.target(name: "Lib")])
EOT
echo 'public let v = 1' > Lib/Sources/Lib/Lib.swift
(cd Lib && git init -q -b main && git add . && git commit -qm 1 && git tag 1.0.0)
cat > App/Package.swift <<EOT
// swift-tools-version: 6.0
import PackageDescription
let package = Package(name: "App", dependencies: [.package(url: "file://$W/Lib", from: "1.0.0")],
  targets: [.executableTarget(name: "App", dependencies: [.product(name: "Lib", package: "Lib")])])
EOT
echo 'import Lib; print(v)' > App/Sources/App/main.swift
ver() { grep '"version" :' App/Package.resolved | head -1 | tr -d ' '; }
(cd App && swift package resolve >/dev/null 2>&1); echo "first resolve:       $(ver)"
(cd Lib && echo 'public let v = 2' > Sources/Lib/Lib.swift && git commit -qam 2 && git tag 1.1.0)
(cd App && swift package resolve >/dev/null 2>&1); echo "after upstream 1.1.0: $(ver)"
(cd App && swift package update >/dev/null 2>&1); echo "after update:        $(ver)"
cp App/Package.resolved saved.resolved; rm App/Package.resolved
(cd App && swift package resolve >/dev/null 2>&1); echo "no resolved file:    $(ver)"
cp saved.resolved App/Package.resolved
sed -i '' 's/from: "1.0.0"/exact: "1.0.0"/' App/Package.swift
(cd App && swift package --force-resolved-versions resolve 2>&1 | grep -o "out-of-date resolved file was detected" | head -1)

• resolve keeps 1.0.0, update moves to 1.1.0, no lockfile gives 1.1.0, and force-resolved fails on a stale lockfile
• resolve always upgrades to the newest version
• force-resolved accepts the stale lockfile