This is why I suggested "May not depend on any package"; that is, presume that you static link everything.
If you permit depending on some packages then this is a risk which the distribution vendor would have to be committed to preventing. Or, the third party repository maintainer might be willing to guarantee/mirror a set of packages at a certain version simply so that the apps can depend on them and only them (and then it's the app store owner's problem if the base distro makes an incompatible change).