silverblue doesn't accomplish goal 3 either... if you need conflicting dependencies to interact in the same environment (i.e. outside a container)
I don't see how it achieves goal #1, what am I missing?
Can you precisely describe what the goal of #1 is. For flatpaks an app's dependency can be specified with a sha256 of the artifact or a specific commit of the dependency.