Incorrect lockfile installed by `deno install --global`

[NfNitLoop]

Version: Deno v2.7.8-2.7.12

Deno was updated in v2.7.8 with PR #32490 to install lockfiles from jsr when doing a global install.

However, that doesn't seem to be working properly.

When I run:

deno install --global --force --reload jsr:@nfnitloop/gemi@0.0.4

I would expect the lockfile at this location to be used:
https://jsr.io/@nfnitloop/gemi/0.0.4/deno.lock

It has specifier:

    "jsr:@hono/hono@^4.8.2": "4.8.2",

But what gets installed in ~/.deno/bin/.gemi/deno.lock has a newer specifier:

    "jsr:@hono/hono@^4.8.2": "4.12.10",

... which seems to defeat the purpose of a lock file. 😅

For more context/details, see my comment on the original feature request:
#30610 (comment)

[dsherret]

I think the issue here is that the lockfile has this workspace in it:

  "workspace": {
    "dependencies": [
      "jsr:@david/dax@~0.43.2",
      "jsr:@hono/hono@^4.8.2",
      "jsr:@noble/ed25519@^2.3.0",
      "jsr:@noble/hashes@^1.8.0",
      "jsr:@std/assert@^1.0.13",
      "jsr:@std/crypto@^1.0.5",
      "jsr:@std/encoding@^1.0.10",
      "jsr:@std/path@^1.1.0",
      "jsr:@std/streams@^1.0.10",
      "jsr:@std/toml@^1.0.8",
      "jsr:@std/uuid@^1.0.9",
      "npm:@types/luxon@^3.6.2",
      "npm:arktype@^2.1.20",
      "npm:bs58@6",
      "npm:bs58check@4",
      "npm:cmd-ts@0.13",
      "npm:luxon@^3.6.1"
    ]
  }

Probably there should be some way internally to tell Deno not to purge dependencies from the lockfile on workspaces changes and that could be used here.