PEP 668 fixes should keep pip check as a second-stage conflict detector
When this applies: a digest-pinned Python base image is externally managed, while an application image must install a separately locked runtime environment into that interpreter. Use the explicit package-manager override only at the controlled mutation sites, keep the externally-…