Possible ensure bug

[tro3]

An unexpected behavior found during adding integration tests. Test cases mentioned are in #265.

In the ensure/update test case, the initial manifest points at a fixed remote repo with version ~0.8.0. The remote repo contains both an 0.8.1 and a 1.0.0. When ensure -update is run on this case, the lock file updates to 1.0.0, but the manifest remains at ~0.8.0. I don't know the expected behavior, but one of those seems incorrect.

[carolynvs]

That was introduced by my PR. I think there's still some confusion on when dep should modify the manifest?

#235 (review)

[tro3]

Holding for upgraded init definition