> It's hardly an end-run around VCS to specify an external dependency's VCS sha, and resolve that at build time

Not "hardly". That's very literally an end-run around the VCS.

This is not a productive discussion.