Use standard gem activation to locate pub_grub

lock only occurs inside a separate CLI invocation, so it's safe to load
a dependency here without it interfering with the client application.

Gemfile.lock

@@ -2,7 +2,6 @@ PATH
   remote: .
   specs:
     gel (2.0.0.alpha2)
-      pub_grub (= 0.5.0.alpha3)
 
 GEM
   remote: https://rubygems.org/
@@ -39,6 +38,7 @@ DEPENDENCIES
   gel!
   minitest (~> 5.0)
   mocha
+  pub_grub (>= 0.5.0.alpha3)
   rake (~> 12.0)
   ronn
   webmock

gel.gemspec

@@ -25,5 +25,5 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency "pub_grub", "0.5.0.alpha3"
+  spec.add_development_dependency "pub_grub", ">= 0.5.0.alpha3"
 end

lib/gel/environment.rb

@@ -111,9 +111,6 @@ def self.lock(store: store(), output: nil, gemfile: Gel::Environment.load_gemfil
       loader = Gel::LockLoader.new(lockfile, gemfile)
     end
 
-    # HACK
-    $: << File.expand_path("../../tmp/bootstrap/store/ruby/gems/pub_grub-0.5.0.alpha3/lib", __dir__)
-
     require_relative "catalog"
     all_sources = (gemfile.sources | gemfile.gems.flat_map { |_, _, o| o[:source] }).compact
     local_source = all_sources.delete(:local)
@@ -168,6 +165,7 @@ def self.lock(store: store(), output: nil, gemfile: Gel::Environment.load_gemfil
       end
     end
 
+    gem "pub_grub"
     require_relative "pub_grub/source"
 
     strategy = loader && preference_strategy && preference_strategy.call(loader)