The secondary header in pebble-app.bin appears to be a variant of the resource header; it is stored at the end of the pebble-app.bin and is followed by two unknown integers which appear to be valid offsets.
This is likely the final protection mechanism against replacing resources in a PBW.