[rubygems/rubygems] Fix standalone install crashing when using legacy multi remote gemfiles

If a legacy multi remote Gemfile depends transitively on a default gem,
then in standalone mode we'd fail to fetch the proper version from the
source that includes it, since we were adding it to `specs` (instead of
`remote_specs`), which was already including the default version of the
gem, and thus preventing the remote version from "overwriting that" and
being added to the index. We should add it to the `remote_specs` index
directly instead.

https://github.com/rubygems/rubygems/commit/05f4f9dfc0

lib/bundler/source/rubygems.rb

@@ -275,7 +275,9 @@ module Bundler
 
         Bundler.ui.debug "Double checking for #{unmet_dependency_names || "all specs (due to the size of the request)"} in #{self}"
 
-        fetch_names(api_fetchers, unmet_dependency_names, specs, false)
+        fetch_names(api_fetchers, unmet_dependency_names, remote_specs, false)
+
+        specs.use(remote_specs, false)
       end
 
       def dependency_names_to_double_check

spec/bundler/install/gemfile/sources_spec.rb

@@ -78,6 +78,33 @@ RSpec.describe "bundle install with gems on multiple sources" do
     end
   end
 
+  context "without source affinity, and a stdlib gem present in one of the sources", :ruby_repo do
+    let(:default_json_version) { ruby "gem 'json'; require 'json'; puts JSON::VERSION" }
+
+    before do
+      build_repo2 do
+        build_gem "json", default_json_version
+      end
+
+      build_repo4 do
+        build_gem "foo" do |s|
+          s.add_dependency "json", default_json_version
+        end
+      end
+
+      gemfile <<-G
+        source "https://gem.repo2"
+        source "https://gem.repo4"
+
+        gem "foo"
+      G
+    end
+
+    it "works in standalone mode", :bundler => "< 3" do
+      bundle "install --standalone", :artifice => "compact_index"
+    end
+  end
+
   context "with source affinity" do
     context "with sources given by a block" do
       before do