bug: preserve application metadata when creating standalone bundles

[codeforester]

Goal

Keep consumer application metadata and behavior intact when scripts/vendor standalone assembles a runnable payload.

Background

standalone_bundle first copies the application into the staging root and then copies the entire framework bundle into that same root. The framework bundle contains its own root VERSION, so the second copy silently overwrites the generated application's VERSION.

On current main, a freshly initialized standard application starts with VERSION=0.1.0; after scripts/vendor standalone APP BUNDLE DEST, DEST/VERSION becomes 2.0.0. The generated application contract explicitly treats VERSION as the application's user-visible version, so the standalone operation changes consumer metadata without warning. The existing standalone smoke only checks that the app runs and does not detect this collision.

Scope

• Define a reserved framework layout or an explicit collision policy for standalone assembly.
• Preserve application-owned root files (at minimum VERSION, and any future application metadata) while keeping the launcher able to resolve the framework runtime and report the framework version.
• Detect and report any unapproved application/framework path collision before the atomic move.
• Extend standalone and project-check tests to assert both application and framework identities.

Acceptance Criteria

• A standalone build leaves the application VERSION and generated application behavior unchanged.
• base-bash --version and framework provenance still report the framework version and commit from the verified bundle.
• Collisions with reserved framework paths fail with a clear diagnostic unless explicitly allowed by the layout contract.
• The existing standalone runtime, vendor-lock, and offline verification tests remain green.

Validation

• ./tests/validate.sh
• Focused tests/vendor.bats coverage for application-version preservation, framework-version reporting, and collision handling.
• Run base-bash check --project against the assembled standalone application.

Non-Goals

• Changing the generated application's versioning policy.
• Adding network access or weakening bundle verification.

Project Fields

• Status: Backlog
• Priority: P1
• Area: Packaging
• Initiative: Adoption Polish
• Size: M
• Milestone: v2.1.0

Agent Assignment

• Assignee: codeforester