Verify gems in out-of-tree bundle config paths

A .bundle/config "path" outside the project (bundle config set
--local path /opt/bundle) is refused as an install root because
apply writes there. That refusal also hid the root from the
read-only checks, so hosted scan gave no stale-install warning and
both the in-run --vex and a later `vex` attested not_affected while
bundler kept loading the unpatched gem from that path.

The refused root is now exposed as a verification-only store: the
hosted stale-install probe and vex's installed-copy lookup read it,
while apply and rollback still never write there. A stale copy
there gets the project-local remedy.

Fixes #709

Assisted-by: Claude Code:claude-opus-5-5

Author: claude