Move module_ctx.watch to after lockfile repin

crate_universe/extensions.bzl

@@ -1112,18 +1112,15 @@ def _crate_impl(module_ctx):
                 fail("Spec specified for repo {}, but the module defined repositories {}".format(repo, local_repos))
 
         for cfg in mod.tags.from_cargo + mod.tags.from_specs:
-            # Preload all external repositories. Calling `module_ctx.watch` will cause restarts of the implementation
-            # function of the module extension when the file has changed.
+            # Watch inputs not modified by the generator. Calling `module_ctx.watch` will cause restarts of
+            # the implementation function of the module extension when the file has changed.
             if cfg.cargo_lockfile:
                 module_ctx.watch(cfg.cargo_lockfile)
-            if cfg.lockfile:
-                module_ctx.watch(cfg.lockfile)
             if cfg.cargo_config:
                 module_ctx.watch(cfg.cargo_config)
             if hasattr(cfg, "manifests"):
                 for m in cfg.manifests:
                     module_ctx.watch(m)
-
             cargo_path, rustc_path = _get_host_cargo_rustc(module_ctx, host_triple, cfg.host_tools)
             cargo_bazel_fn = new_cargo_bazel_fn(
                 repository_ctx = module_ctx,
@@ -1180,6 +1177,12 @@ def _crate_impl(module_ctx):
                 strip_internal_dependencies_from_cargo_lockfile = cfg.strip_internal_dependencies_from_cargo_lockfile,
             )
 
+            # Watch cfg.lockfile AFTER generation. The generator may modify it during
+            # repin, and in Bazel 9 module_ctx.read verifies digests for files already
+            # read, which would crash if the lockfile changed between watch and read.
+            if cfg.lockfile:
+                module_ctx.watch(cfg.lockfile)
+
     metadata_kwargs = {}
     if bazel_features.external_deps.extension_metadata_has_reproducible:
         metadata_kwargs["reproducible"] = reproducible