Why will my ALTER and UPDATE not work in the same query in this specific instance?
Do you have the option to create the new columns outside of this stored procedure via change control?

Alternatively, you could use default constraints if your business requirements allow the columns to be not null:

CREATE PROCEDURE [dbo].[p_app_2_24_01]
AS
    -- SET NOCOUNT ON added to prevent extra result sets from
    UPDATE [dbo].[app_Config] SET CFG_Value = '2.24.01'  WHERE CFG_KEY = 'VER'


    ALTER TABLE [dbo].[app_table1] ADD [Bonus] int NOT NULL CONSTRAINT df_app_table1_Bonus DEFAULT (999);
    ALTER TABLE [dbo].[app_table1] ADD [Allow] bit NOT NULL CONSTRAINT df_app_table1_Allow DEFAULT (1);
    ALTER TABLE [dbo].[app_table1] ADD [Discount] int NOT NULL CONSTRAINT df_app_table1_Discount DEFAULT (100);

    ALTER TABLE [dbo].[app_table2] ADD [Bonus] int NOT NULL CONSTRAINT df_app_table2_Bonus DEFAULT (999);
    ALTER TABLE [dbo].[app_table2] ADD [Allow] bit NOT NULL CONSTRAINT df_app_table2_Allow DEFAULT (1);
    ALTER TABLE [dbo].[app_table2] ADD [Discount] int NOT NULL CONSTRAINT df_app_table2_Discount DEFAULT (100);
GO


If your columns must be nullable, then use the WITH VALUES clause:

CREATE PROCEDURE [dbo].[p_app_2_24_01]
AS
    -- SET NOCOUNT ON added to prevent extra result sets from
    UPDATE [dbo].[app_Config] SET CFG_Value = '2.24.01'  WHERE CFG_KEY = 'VER'


    ALTER TABLE [dbo].[app_table1] ADD [Bonus] int NULL CONSTRAINT df_app_table1_Bonus DEFAULT (999) WITH VALUES;
    ALTER TABLE [dbo].[app_table1] ADD [Allow] bit NULL CONSTRAINT df_app_table1_Allow DEFAULT (1) WITH VALUES;
    ALTER TABLE [dbo].[app_table1] ADD [Discount] int NULL CONSTRAINT df_app_table1_Discount DEFAULT (100) WITH VALUES;

    ALTER TABLE [dbo].[app_table2] ADD [Bonus] int NULL CONSTRAINT df_app_table2_Bonus DEFAULT (999) WITH VALUES;
    ALTER TABLE [dbo].[app_table2] ADD [Allow] bit NULL CONSTRAINT df_app_table2_Allow DEFAULT (1) WITH VALUES;
    ALTER TABLE [dbo].[app_table2] ADD [Discount] int NULL CONSTRAINT df_app_table2_Discount DEFAULT (100) WITH VALUES;
GO


Lastly, you could use sp_executesql to perform the updates. You are not introducing a SQL injection risk as the update values are not parameterised.