fix issue where locked dependencies weren't being merged with explicit

this will prevent new values from being written out to a lockfile if
new versions which satisfy a constraint become available.
prevent loading of locked dependencies which are not accessible or valid