bug: make standalone vendor copies pass vendor verification

[codeforester]

Related roadmap: #214

Problem

scripts/vendor standalone creates a vendor/base-bash-libs copy described as auditable, but it never writes base-bash-libs.lock into that copy. The repository's own scripts/vendor verify command therefore rejects the embedded vendor tree.

The test intended to assert the lock exists is vacuous because it ends with || true.

Evidence

Reviewed on main at 63753047312cd5c189600ed71597faceae0f5d8e.

Focused reproduction:

1. Build a framework directory bundle.
2. Generate a standard app.
3. Run scripts/vendor standalone APP BUNDLE STANDALONE.
4. Run scripts/vendor verify STANDALONE/vendor/base-bash-libs.

Actual result: status 1, vendor destination lacks lock or hash metadata; the lock file is absent.

tests/vendor.bats:51 currently uses [ -f .../base-bash-libs.lock ] || true, so the missing contract cannot fail CI.

Acceptance criteria

• Give the embedded vendor copy a valid lock bound to its MANIFEST.sha256, version, and source commit.
• Make scripts/vendor verify STANDALONE/vendor/base-bash-libs pass for a freshly created standalone application.
• Remove the unconditional-success assertion and verify the embedded vendor tree in tests.
• Keep standalone creation offline, deterministic, and atomic.
• Document whether root and embedded copies are both authoritative and how consumers verify each one.