Seems like PDM has something very close to what I have in mind: Override the resolved package versions. I am quite sure I had investigated PDM, I must have missed it…
If I understood correctly, one can add a pdm.toml file in their own copy of the project source tree (without committing this file), with content such as this:
I came across this thread when doing research for dependency specification and just wanted to add that uv supports overriding dependencies, currently with a -o/--overrides flag that has a similar input format to -c/--constraints (a limited requirements.txt syntax).