Skip the bundle app config under BUNDLE_IGNORE_CONFIG

Bundler's load_config returns {} whenever BUNDLE_IGNORE_CONFIG is set,
so a cache_path or gemfile setting in .bundle/config is then ignored.
The stale-install guard still followed the ignored cache_path, skipped
the vendor/cache archive bundler actually installs from, and attested
the purl. Both settings now read the app config through one reader
that honors the switch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MWt5CXPnmqVEUZe4wnCfgX

Author: claude

CHANGELOG.md

@@ -113,6 +113,8 @@ limits, and required install commands.
   the committed archive in Bundler's configured cache dir (`cache_path` /
   `BUNDLE_CACHE_PATH`) instead of always `vendor/cache`, so a stale archive
   there now warns and keeps the same run's VEX from attesting it (#483).
+  Both settings skip `.bundle/config` under `BUNDLE_IGNORE_CONFIG`, as Bundler
+  does.
 - **npm dependencies installed from git, a URL or `file:` are no longer
   reported patched.** npm installs such a dependency from the dependent's
   spec (`github:user/repo`, `https://…/x.tgz`, `file:…`) and ignores the