Validate only explicitly requested gems against the lockfile

explicit_gems aliased the same array that the --group handling mutates
with concat, so group-derived gems leaked into the lockfile presence
check and bundle update --group failed on gems newly added to the
group. Copy the array before it gets mutated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hsbt

bundler/lib/bundler/cli/update.rb

@@ -42,7 +42,7 @@ def run
           raise GemfileLockNotFound, "This Bundle hasn't been installed yet. " \
             "Run `bundle install` to update and install the bundled gems."
         end
-        explicit_gems = gems
+        explicit_gems = gems.dup
 
         if groups.any?
           deps = Bundler.definition.dependencies.select {|d| (d.groups & groups).any? }

spec/commands/update_spec.rb

@@ -744,6 +744,23 @@
       expect(the_bundle).not_to include_gems "myrack 1.2"
     end
 
+    it "doesn't fail when a gem was added to the group but is not in the lockfile yet" do
+      install_gemfile <<-G
+        source "https://gem.repo2"
+        gem "activesupport", :group => :development
+      G
+
+      gemfile <<-G
+        source "https://gem.repo2"
+        gem "activesupport", :group => :development
+        gem "myrack", :group => :development
+      G
+
+      bundle "update --group development"
+
+      expect(the_bundle).to include_gems "myrack 1.0.0"
+    end
+
     context "when conservatively updating a group with non-group sub-deps" do
       it "should update only specified group gems" do
         install_gemfile <<-G