Defensive follow-up to 07e2d9d. The vault metal-only branch keys on the app name
tracked from 2-space header lines across bundle.yaml then the overlay. bundle.yaml is
VIP-free (ruling 3) so no stale name can currently leak, but reset name="" on each
applications: block as cheap insurance if bundle.yaml ever regains a vip -- otherwise a
stale bundle key could grade the first overlay vip line under the wrong app.
pre-flight-checks harness 32/0; repo-lint 0 fail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728