Deleting a vendored @scope/package/x.x.x_meta.json file leads to an error on next load if locked

[dsherret]

// main.ts
import "jsr:@std/[email protected]";
// deno.json
{
  "vendor": true
}

> deno install -e main.ts
> rm vendor/jsr.io/@std/path/1.0.9_meta.json
> deno install -e main.ts
error: Integrity check failed for package. The source code is invalid, as it does not match the expected hash in the lock file.

  Package: @std/[email protected]
  Actual: 260a49f11edd3db93dd38350bf9cd1b4d1366afa98e81b86167b4e3dd750129e
  Expected: 6e58f71445044e44650ff4fb31f93ce4673dd1e85a67914cf8ed09a19a3c9ab2

This could be caused by:
  * the lock file may be corrupt
  * the source itself may be corrupt

Investigate the lockfile; delete it to regenerate the lockfile or --reload to reload the source code from the server.

Caused by #29120

Version: Deno 2.3.3

[dsherret]

Another better more reliable reproduction with the same setup as before:

# create the vendor folder without a lockfile
> deno install --no-lock -e main.ts
# now cause the lockfile to be created
> deno install -e main.ts
> rm vendor/jsr.io/@std/path/1.0.9_meta.json
> deno install -e main.ts # will cause the error above