fix(runtime): synchronize lockfile after builtin plugin migration

image/reconcile-profile.test.mjs

@@ -49,7 +49,8 @@ test('migrates all sections, backs up exact bytes, replaces atomically with 0600
   assert.deepEqual(f.run(), { changed: false });
   assert.equal(statSync(f.path).ino, before.ino);
   assert.equal(statSync(f.path).mtimeMs, before.mtimeMs);
-  assert.equal(readdirSync(f.profile).length, 2);
+  assert.equal(readdirSync(f.profile).length, 3);
+  assert.equal(readFileSync(join(f.profile, '.dsh-lockfile-pending'), 'utf8'), 'builtin profile migration\n');
   writeFileSync(f.path, f.original);
   assert.notEqual(f.run().backupPath, first.backupPath);
   assert.equal(readFileSync(first.backupPath, 'utf8'), f.original);
@@ -105,8 +106,9 @@ const durableWriteOrder = [
   'open:backup', 'write:backup', 'fsync:backup', 'close:backup',
   'open:directory-1', 'fsync:directory-1', 'close:directory-1',
   'open:temporary', 'write:temporary', 'fsync:temporary', 'close:temporary',
-  'rename:manifest',
   'open:directory-2', 'fsync:directory-2', 'close:directory-2',
+  'rename:manifest',
+  'open:directory-3', 'fsync:directory-3', 'close:directory-3',
 ];
 
 test('syncs backup and directory before replacement, then syncs the renamed manifest directory', t => {
@@ -201,7 +203,7 @@ test('invalid JSON and malformed sections fail without changing original', t =>
 });
 
 test('rejects manifest/workspace symlinks, dangling links and directories', t => {
-  for (const name of ['package.json', 'pnpm-workspace.yaml']) {
+  for (const name of ['package.json', 'pnpm-workspace.yaml', 'pnpm-lock.yaml', '.dsh-lockfile-pending']) {
     for (const kind of ['symlink', 'dangling', 'directory']) {
       const f = fixture(t, { dependencies: { 'dsh-web-mobile': old('dsh-web-mobile') } });
       const target = join(f.root, 'outside');