build targets ignore lock files

All our build targets automatically run update. This means that we effectively ignore the lock file when deploying our services because the build process just overwrites them with the most recent dependencies.

Given the way we do deployments this actually even means prod and beta could be running completely different versions of the service dependencies.

I'm not sure if there is some legit reason to do this by default in some environments, but suggest we make updating dependencies an explicit action, not the default and definitely don't do it as part of deploy.

Start by locating the build targets that run dependency updates and the deployment entry point. Trace when lock files are replaced during beta and production deployments. Done means deployment preserves the locked dependencies, while updating dependencies is available only as an explicit action.