* refactor(manager/pixi): extract shared pixi.lock update helper
* test(manager/pixi): cover shared pixi.lock helper directly
Add a dedicated lockfile.spec.ts that exercises updatePixiLockfile
directly (gate, package-file write branch, lockfile maintenance,
unchanged, constraint pass-through, and error handling), and slim the
pixi and pep621 call-site specs down to their own behavior: how each
derives the pixi constraint and that they delegate to the shared helper.
feat(manager/pixi): gate pixi.lock updates behind allowedUnsafeExecutions
The pixi manager runs `pixi lock`, which can execute arbitrary code from
conda package hooks. It now only updates `pixi.lock` when `pixi` is
included in the global `allowedUnsafeExecutions` option, following the same
pattern as the `mise` manager. When `pixi` is not allowed, the package file
is still updated but `pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
As `fileName` makes more sense (as it's not always a lock file we're
updating).
Also, if you set `fileName`, it would never actually output the
filename.
This renames the usages of `lockFile` to `fileName`.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
Niels Pardon