Fixed binary artifact downloads and Package.resolved churn

Binary artifact downloads (such as xcframeworks from GitHub releases) now correctly request the actual binary asset instead of the asset metadata JSON, so checksum mismatches on binary targets are resolved. The Package.resolved file is also now written only when its content changes, keeping file modification times stable and reducing unnecessary churn. Declared dependency locations (including SSH, mixed-case, or .git URLs) are preserved exactly as written, and existing pins are reused on resolve rather than floating every dependency to its newest allowed version. A first-time cache-hit resolve may still produce a formatting-only normalization diff, but this is a one-time migration with no semantic impact.