feat: allow explicit retargeting of existing bundles

[Tom-R-Main]

Summary

Allow explicit target updates for existing bundles:

internationalizer config plan --update-bundle marketing \
  --target 'marketing=locales/{locale}.json' --out repair-plan.json --json

• Preserve bundle identities, comments, provider settings, locale overrides, and omitted fields. Legacy source-path configuration migrates to the stable default bundle.
• Reject missing, duplicate, unknown, or conflicting decisions. A target override alone cannot silently modify an existing bundle.
• Report unsafe paths with bundle, role, and locale context. Bounded link-metadata inspection may suggest an in-project destination but never selects it or opens catalog content.
• Validate explicit replacements independently of old symlinks. Apply rechecks replacement paths and preserves existing drift, lock, tamper, and replay protections; saved-plan schema stays unchanged.

Verification

• Full go test ./... -race -count=1 with coverage on the integrated 0.2.1 candidate: passed; aggregate statement coverage 79.0%.
• go vet ./..., golangci-lint run, and CLI build: passed.
• npm wrapper tests (4), version consistency, and package dry-run: passed.
• Synthetic 21-symlink marketing fixture plans and applies a retargeting without changing catalogs or links.
• Release-binary smoke test passed 176 CLI invocations, including 160 deterministic integrity failures and the 21-link plan/apply/replay/check/dry-run workflow, with zero provider calls. The installed npm wrapper will be checked again after publication.
• Regression coverage includes external, dangling, cyclic, ancestor, and late-introduced replacement symlinks; settings preservation and explicit decision validation. Repeated updates change two bundles while preserving a third and leaving the original config untouched during planning.
• Independent review found no confirmed defects. Cross-platform CI remains the remote gate.

Plan completion and scope

Existing-bundle retargeting scope is complete. JSON-integrity PR #10 merged first and is integrated here. Release notes preserve both changes, including the reviewed numeric-array append fix.

ExecuFunction configuration and catalogs were not changed. CLI onboarding documentation describes the update contract. All six npm package manifests and platform dependency pins are prepared for 0.2.1. Publication will run from the merged commit through the existing tag-triggered release workflow after this PR passes CI and merges.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T21:52:59.950997Z	4c16114	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.