security: verify staged vendor bytes before atomic install

[codeforester]

Problem

scripts/vendor verifies an input bundle once and then copies files from that bundle into a staging tree without rechecking the source or the copied bytes. A payload can therefore change after verification and before the atomic move, producing a destination whose MANIFEST.sha256 no longer describes its contents.

This contradicts the command's immutable vendor/install contract and also affects the two framework copies assembled by scripts/vendor standalone.

Verified evidence

On a clean verified bundle, a harmless cp test shim changed VERSION after verify_bundle returned. scripts/vendor create reported success and moved the staging tree into place; scripts/vendor verify then failed with bundle hash mismatch: VERSION.

Scope and acceptance criteria

• Revalidate staged bytes against the bundle manifest before the final atomic move.
• Detect source mutation or copied-byte mismatch for create, update, and standalone.
• Fail closed and remove incomplete staging trees without replacing an existing destination.
• Keep the workflow offline, atomic, and free of bundle-data evaluation.
• Add regression coverage for mutation after initial verification and for consistency of both standalone framework copies.

Validation

Run the affected vendor tests, the full ./tests/validate.sh suite, and the repository quality gates.

Non-goals

No network fetches, release changes, or changes to the application payload allowlist.