These were originally separated because spin-app depended on spin-core / wasmtime and spin-locked-app had some dependents that didn't otherwise need wasmtime.
With #2753 this is no longer the case and it would probably be a nice simplification to merge these two crates, with spin_locked_app becoming e.g. spin_app::locked.