Revert "switch to One True Cartridge.lock"

This reverts commit 72a3a7493e142779861d3df11b11a1bd5f84e7b4.
use bleeding-edge for everything

The hope is to find a workflow that keeps us from straying behind in
separate components, while also locking them down individually for CI
and release cutting, etc. This accomplishes the second and "eventually"
accomplishes the first, as using bleeding-edge means we're constantly
bumping automatically during development.