We expect lockfiles to change when we update it add dependencies. If a pull request cannot build with a lockfile generated when it is merged then that change should not be merged.
This isn't true at all. You can't predict when a new, potentially breaking, version of a dependency might get published. It could happen a second after you generate your lockfile, or create your PR.
At time of PR creation we could have versions 1, 2, 3 and 4 of our transitive dependencies.
At time of merge we could have versions 1.1, 2.2, 3.3 and 4.x available.
Dependencies are outside of your control, so always "smell", that's why it's crazy to do anything other than pin the heck out of them.