feat: collision hard errors + rename resolution

- flat per-type deployed namespace enforced across own items and all sources
- own-vs-vendored and vendored-vs-vendored collisions abort with both parties named
- --rename upstream=deployed resolves collisions; on-disk folder always equals
  deployed name; rename targets are validated against new collisions
- checks run before any tree mutation; validate re-checks the namespace offline

internal/cli/vendor.go

@@ -23,20 +23,27 @@ func newVendorCmd() *cobra.Command {
 func newVendorAddCmd() *cobra.Command {
 	var ref string
 	var include []string
+	var renames []string
 	cmd := &cobra.Command{
 		Use:   "add <name> <url>",
 		Short: "Vendor a new external git source",
 		Long: "Clones the source (in-process, via go-git), discovers skills, commands,\n" +
 			"agents and MCP fragments, materializes the selection under external/<name>/\n" +
 			"and pins URL, ref, revision, selection and renames in the lockfile.\n" +
-			"Default selection is everything; --include switches to an explicit list.",
+			"Default selection is everything; --include switches to an explicit list.\n" +
+			"Collisions abort with a hard error; resolve them with --rename upstream=deployed.",
 		Args: cobra.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
+			renameMap, err := vendor.ParseRenames(renames)
+			if err != nil {
+				return err
+			}
 			opts := vendor.AddOptions{
 				Name:    args[0],
 				URL:     args[1],
 				Ref:     ref,
 				Include: splitList(include),
+				Renames: renameMap,
 			}
 			if err := vendor.Add(".", opts, cmd.OutOrStdout()); err != nil {
 				return fmt.Errorf("vendor add: %w", err)
@@ -46,6 +53,7 @@ func newVendorAddCmd() *cobra.Command {
 	}
 	cmd.Flags().StringVar(&ref, "ref", "", "branch or tag to track (default: the source's default branch)")
 	cmd.Flags().StringSliceVar(&include, "include", nil, "comma-separated item ids to vendor (switches selection to include mode)")
+	cmd.Flags().StringSliceVar(&renames, "rename", nil, "deployed-name override upstream-id=deployed-name (repeatable)")
 	return cmd
 }