always resolve dependencies

at present if there's a lockfile all the dependencies from it are
returned, which blows at least :except (and probably :only) out of the
water. Now we'll try and use locked versions, but only after resolving
the groups we want.