RPM seems to be focused on Linux and globally managing the whole system though, but yeah, something like that. Probably would require to work more like in cargo or npm with a per-project list.

Agreeing on one format is kind of the point. I know it is difficult, but I think it is possible if at least a few implementations agree on something. Maybe some kind of "backend" like LLVM which could be used by cargo, npm, maven, etc. to configure their resolution strategy. Probably only a dream though.