Pin agency commit in apm.yml, gitignore broken lock file

The lock file only records the last target's deployed files, making
it useless for multi-target workflows. Pin commits in apm.yml instead
and rely on vendored output as the source of truth.

See: microsoft/apm#529

Author: srid

.gitignore

@@ -13,5 +13,9 @@ result-*
 # APM dependencies (source cache, not vendored output)
 apm_modules/
 
+# Lock file is broken with multiple targets (https://github.com/microsoft/apm/issues/529)
+# We pin commits in apm.yml and vendor the output directly.
+apm.lock.yaml
+
 # Do workflow
 .do-results.json

apm.lock.yaml

@@ -4,6 +4,6 @@ description: Nix flake for AI coding agents
 author: Sridhar Ratnakumar
 dependencies:
   apm:
-  - srid/agency#master
+  - srid/agency#7fc84d15e9c48395d2c093c9d275939bf05738f6
   mcp: []
 scripts: {}