Warn users of changes to package resolution?

[jimporter]

To help make more reproducible builds, we could keep track of the exact results of package lookups. This way, even if something about the environment changes, we'll still have consistent results (although sometimes this might just mean a build failure).

(See also jimporter/bfg9000#10)