fix(cli): pin --vendor leaves a pin to a custom URL alone - #41

This commit only merges another branch into the PR branch, so cubic completed this check without running an AI review. cubic will review your next non-merge commit.