fix: reject bundle version changes during install

[rksharma-owg]

Closes #4434

Description

A normal bundle install treated an existing bundle as satisfied by component ID alone, then rewrote the installed-bundle record to a newer version while leaving owned components unchanged. This guard rejects a version-changing normal install before any primitive work and directs users to specify bundle update, which refreshes components before updating provenance. Same-version installs remain idempotent.

Testing

• Tested locally with uv run specify --help
• Ran the focused bundler test suite: 319 passed
• Reproduced the new regression on the pre-fix commit (the test failed because no error was raised), then verified it passes with the fix
• git diff --check
• Full test suite is completely green

The full suite ran as 7,522 passed, 195 skipped, and 11 unrelated pre-existing environment/platform failures (PowerShell launcher and composed-template parity tests).

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance

This PR was written with assistance from ChatGPT, which researched the issue, implemented the focused guard and regression test, and ran validation under the contributor account.