fix: detect host/build dependency changes in --check/--dry-run

[baszalmstra]

Description

--check/--dry-run keyed off LockFileDiff, which only compares resolved packages by location and so misses host/build dependency edits to source packages. Now they key off the lock_updated re-solve signal instead. --check returns an error rather than exit(1). Adds a regression test.

Fixes #6445

How Has This Been Tested?

Added a unit test.

AI Disclosure

• This PR contains AI-generated content.
  • I have tested any AI-generated content in my PR.
  • I take responsibility for any AI-generated content in my PR.

Tools: Claude Opus 4.8

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added sufficient tests to cover my changes.
• I have verified that changes that would impact the JSON schema have been made in schema/model.py.