Found during the investigation of #7836 (comment).
The dgspec.json write does not have a dirty check.
Currently it's being overridden even during no-op scenarios where nothing has changed.
The issue was introduced in the original PR NuGet/NuGet.Client#2521