When resolving from the lockfile we don't query the registry and so cannot detect yanked versions. We should document this or add an explicit check for yanked versions even when resolving from the lockfile.