Fix nondeterministic Cartfile.lock ordering

Resolves #190.

/cc @justinmakaila @joshaber