Fixed binary artifact downloads and reduced spurious Package.resolved changes

Binary artifact downloads (for example, GitHub release assets like Sparkle’s xcframework) now send the correct Accept header, so they download the actual archive instead of API metadata and no longer fail with checksum mismatches. Resolution also preserves declared dependency locations, seeds the solver from your existing Package.resolved, and skips rewriting the lockfile when its content is unchanged, which means fewer unexpected diffs and mtime updates between runs.