[SkyPuncher]

> Without a deterministic build I don't know what I check in actually works across environment, or if the deployment artifact works.

I use to have this concern, but it's really not an issue with modern package managers. Even without a checksum in a lock file (e.g. gem bundler), I haven't actually had a deployment break because of dependencies changes. The biggest issue is being blocked for a couple hours because a package repo went down.

Most of this is solved by using a self-hosted or 3rd party proxy package manager.