vx lock: freezing what the key sees
Configs are programs and programs can read the environment. vx lock evaluates every config now and writes the resolved objects to a lockfile; vx run --frozen uses them without evaluating; vx lock --check catches drift a byte hash cannot see.