Don't allow lock without spec file.

tests/pkg/assets/missing-spec/gold/test.gold

@@ -0,0 +1,3 @@
+Aborted
+[pkg, install]
+Error: Project has a lock-file, but no specification file.

tests/pkg/assets/missing-spec/package.lock

@@ -0,0 +1,8 @@
+prefixes:
+  pkg1: pkg1
+
+packages:
+  pkg1:
+    url: 'http://localhost:<[*PORT*]>/pkg/pkg1'
+    version: 1.0.0
+    hash: deadbeef1234567890abcdef1234567890abcdef

tests/pkg/missing-spec-gold-test.toit

@@ -0,0 +1,11 @@
+// Copyright (C) 2025 Toit contributors.
+// Use of this source code is governed by a Zero-Clause BSD license that can
+// be found in the tests/LICENSE file.
+
+import .gold-tester
+
+main args:
+  with-gold-tester --with-git-pkg-registry args: test it
+
+test tester/GoldTester:
+  tester.gold "test" [["pkg", "install"]]

tools/pkg/project/project.toit

@@ -74,6 +74,10 @@ class Project:
       --empty-lock-file/bool=false
       --ui/cli.Ui:
     ui_ = ui
+
+    if config.lock-file-exists and not config.specification-file-exists:
+      ui.abort "Project has a lock-file, but no specification file."
+
     if config.specification-file-exists:
       specification = ProjectSpecification.load this --ui=ui
     else: