docs(adr): revise ADR-0048 — package-scoped identity over per-item collision detection

Re-examine the cross-package metadata collision problem through the
app-marketplace install lens. Per-item collision detection (shipped) makes
two independent vendors that both ship a bare-named `page/home` unable to
coexist — wrong for a marketplace.

Revised direction:
- package id (reverse-domain) is the global identity + routing/container key
  (vendor baked in → two vendors' "crm" never collide; URL-safe)
- namespace stays the object prefix, enforced unique per-install at install
  time (refuse-on-conflict) — making explicit the constraint the table layer
  already enforces implicitly
- resolution is container-scoped (prefer-local, qualify-to-cross), so a
  cross-package clash is structurally impossible rather than detected
- the shipped runtime guard is retained as a same-package authoring backstop
- namespace rename-on-install is an explicit non-goal for v1

Docs-only. The runtime guard + os lint rule remain accurately labelled [done];
the install gate + container-scoped resolution are labelled [proposed].

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang