feat: collision hard errors + rename resolution

- flat per-type deployed namespace enforced across own items and all sources
- own-vs-vendored and vendored-vs-vendored collisions abort with both parties named
- --rename upstream=deployed resolves collisions; on-disk folder always equals
  deployed name; rename targets are validated against new collisions
- checks run before any tree mutation; validate re-checks the namespace offline

internal/vendor/query.go

@@ -33,6 +33,7 @@ func Validate(workDir string, lf *lockfile.Lockfile) Validation {
 		v.checkSelection(name, src)
 		v.checkExternalArea(workDir, name, src)
 	}
+	v.Errors = append(v.Errors, validateCollisions(workDir, lf)...)
 	sort.Slice(v.Errors, func(i, j int) bool {
 		if v.Errors[i].Source != v.Errors[j].Source {
 			return v.Errors[i].Source < v.Errors[j].Source