First pass at a great workflow RFC to rule them all.

You don't need a vendorfile or a vendorfile.lock, because you are doing a literal vendor branch. The source of truth for your deps is the repository, full stop.

Lets say you give the cookbook you want as an optional input, just like you would with knife cookbook site install today.