[Bug] Local bundle install can advance records without updating existing components

Bắt đầu từ đường dẫn cài đặt bundle xử lý lệnh offline và tái hiện bản cập nhật với workflow, các extension và preset hiện có. Kiểm tra cách .specify/bundle-records.json cùng các manifest hoặc registry nguyên thủy được ghi; được xem là hoàn tất khi các component có phiên bản không khớp được cập nhật trước khi record được chuyển tiếp, lỗi giữ lại record nhất quán trước đó và các thao tác ghi vào registry dùng chung được tuần tự hóa.

Spec Kit version

Reproduced with specify 1.0.4 on Windows.

Reproduction

1. Install a bundle version whose workflow, two extensions, and preset are already present in an initialized project.
2. Point a clean local release directory at a newer version of the same bundle and components.
3. Run:

specify bundle install C:\path\to\new-release\bundle.yml --offline --integration codex

The command reports success, for example:

Installed 'program-kit' (0 added, 4 already present).

It advances .specify/bundle-records.json and its contributed-component versions to the new bundle version, but the installed workflow/registry, extension manifests, and preset/registry can remain at the old version. A subsequent component tool can therefore appear current while executing old code.

When components were installed individually before the bundle, the successful local bundle install can instead create a record without the expected contributed-component entries because every primitive is classified as already present.

Expected behavior

Bundle installation/update should be transactional across its record and primitive installations:

• update every component to the resolved version before advancing the bundle record;
• validate installed manifests and registries against the resolved bundle before returning success;
• retain the previous coherent record or fail if a primitive update fails; and
• serialize writes when multiple extensions share registry/configuration files.

At minimum, an existing component with a different version must not be treated as satisfied solely because its ID is present.

Impact

The project records a coherent new bundle version while continuing to execute old extension code. In the observed consumer, managed synchronization misleadingly reported all files unchanged until each workflow, extension, and preset was explicitly reinstalled in sequence.