Filed a bug with composer: https://github.com/composer/composer/issues/1351
Hm, hardcoding versions will be a royal pain in terms of release management - you'd have to remember to commit those *just* before tagging, each time. We could read/write the composer.json dynamically with the "phing tag" build command, but that sounds like a lot of work for a stopgap solution.
But more importantly, it breaks the collaboration model. We ask people to simply use "composer update --dev" to get started if they want to contribute. That won't work, since framework and cms will still be at the checked out tag.
For now, I've updated the contributing chapter: https://github.com/silverstripe/sapphire/commit/96acd5068129b9098768ee5ab8431fcfa34db9d7