Enforce manifest roots and surface revision/metadata

BundleAssembler parses .manifest into a Map<String,Object> and stores it on the Bundle, but nothing reads it. Per the OPA bundle spec, the roots field is required to constrain which paths a bundle owns and to detect overlap when multiple bundles are loaded. Revision and custom metadata are also exposed by OPA but currently inaccessible.

• Validate roots at activation: reject paths in the bundle that fall outside any root.
• Detect collisions across active bundles (overlapping roots → activation error).
• Expose revision and metadata via typed accessors on Bundle (or its successor — see the manifest-typing issue).
• Tests covering: missing roots, root-violation in data/policy paths, cross-bundle overlap.

Start with BundleAssembler and Bundle, then trace the activation flow where manifests are parsed and bundles become active. Check the OPA bundle specification and the manifest-typing issue before designing typed accessors. Done means missing roots, root violations in data and policy paths, and overlaps across active bundles are rejected, with revision and metadata accessible and covered by tests.