Define Bundle Semantics: Pack vs. Unpack Resolution, License Verification, and Metadata Standardization

## Context
In the last Gemara Community Meeting (05/28), we discussed multiple solutions for handling dependencies when packaging Gemara artifacts into signed OCI artifact bundles.

We currently have two workflows:

1. Build Time Resolution: Pulling and flattening all dependency layers into a single OCI bundle manifest under a single root artifact.
2. Run Time Resolution: Keeping artifacts lightweight and resolving their mapping references (URLs, file paths, or OCI coordinates) dynamically at runtime.

As we scale out the ecosystem, we need to formalize the bundling specifications, specifically around handling mixed visibility and licensing compliance.

## Problem

1. Dependency Resolution: If we mandate pack-time bundling, the compiler must have read access to all mapped dependencies, which breaks down when mapping to proprietary frameworks. However, deferring resolution to runtime introduces fragility, if external registries are down, unauthenticated, or the asset has been deleted, compliance gates will break during active runtime execution rather than safely failing at build time.
2. Mixed Visibility: Bundling upstream assets into a single OCI manifest assumes uniform access controls. This fails when public community policies map to proprietary or restricted compliance frameworks (e.g., a public policy mapping to an ISO catalog that cannot legally be bundled and distributed publicly).
3. Incompatible Licenses: Packaging multiple assets from distinct upstream maintainers (e.g., Finos, CNCF, OpenSSF) into a single distributed OCI artifact introduces critical legal risks if licenses conflict. Forcing full SBOM generation at this phase creates substantial tooling overhead for the publisher, yet distributors require a reliable way to verify compliance before registry ingestion.

## Proposed Solution

To balance consumer reliability with distributor liability, proposing a *Smart Bundling* strategy.

1. Mapping Gemara Primitives to OCI Artifacts
Explicitly leverage existing Gemara primitives to drive OCI bundle structure rather than inventing new packaging configuration files. At build time, the compiler will parse the standard `mapping.references[]` array declared inside the author's Gemara YAML content:
* For compliant/visible references: The bundler reads the mapping coordinate, verifies schema correctness, checks the license compatibility, and automatically flattens that target asset into a native OCI layer within the bundle manifest.
* For restricted/proprietary references: The compiler automatically pivots, omitting the physical layer to protect the distributor, and instead translates that primitive link into a native OCI structural relationship (detailed below).

2. Enforce License Guardrails in the Bundler
To address licensing incompatibility while preserving OCI-native reliability, the packaging tool will act as the gatekeeper for all-in-one bundles. By default, it will flatten all available and license compatible dependency layers into a single atomic unit. For edge cases where mixed-visibility or licensing constraints make physical bundling legally or technically impossible, we could evaluate the OCI Referrers API instead of custom string parsing. This allows a public policy to formally "refer" to external or private target catalogs in the registry.

3. Leverage OCI Manifest Annotations for Lightweight Compliance
Rather than relying on heavy, complex SBOM generation inside the artifact layers, handle license verification directly in the manifest metadata. Include standard fields in metadata: license.url and license.spdx-identifier. Expose these attributes directly via native OCI annotations, allowing registries, frontends, and distributors to discover license visibility and conflicts instantly without unpacking or pulling raw asset blobs.

4. Recommend Pre-Flight Diagnostic Checks
For any evaluations forced to utilize external linkages or referrers, recommend consumers enforce a strict check phase. Before initiating a time-sensitive scan, the runtime tool should verify the reachability and authentication status of all external OCI targets to fail fast before breaking mid-evaluation.

5. Standardize Mapping Reference Formats
Formally recommend and support OCI Coordinates as the predictable, standardized string format for remote mappings (replacing freeform strings). This unlocks the ability for registry frontends to parse the metadata and automatically generate dependency cross-linking on asset preview pages.