After #596 goes in, we can implement support for installing a bundle from a URL instead of resolving it from a catalog. To do this, we'll have a very strict set of guardrails:

1. The bundle must be a registry+v1 bundle
2. We will do minimal or no constraint/dependency checking - a direct bundle installation is considered "satisfied"