fix(add): Update the lock file

fix(add): Update the lock file

This is done in the command, rather than in the op,
- To consistently construct the `Workspace`
- It is more composable as an API

A downside is we update the git dependencies a second time.

We are not rolling back on error.
- For some errors, the user might want to debug what went wrong
- Rollback adds its own complications and risks, including since its
  non-atomic

Fixes #10901