Works for me on the command line. Also works using most recent changes copied out of the script and into your test:

unless (&check_name($app{"first_name"})) {
    undef $app{"first_name"};
    push (@errors, "Helpful message...");
}
[download]

It still doesn't work in CGI. I added use Data::Dumper and to the actual script and "Dumper" to the end of the &print_application function:

sub print_application {
    header,
    start_html,
    table({-border=>'0' -class=>'boxed'},
    Tr(
        [
            td([b('First Name:'), "$app{'first_name'}"])
        ]
    ),
    p("Value is", $app{'first_name'}),
    pre(
        Dumper \@errors,
        Dumper \%app
    ),
    end_html;
}
[download]

Oddly enough, this is what comes out the other side:

A form element with the value "nameCheckFailsIfNumbersPresent12345" in
+ a table, and...

Value is  # <- undef here has it should be. But not above?

$VAR1 = [
          'Names must be between two and forty total characters, start
+ with an initial capitol, and may only contact alphabetical character
+s, a dash, or an apostrophe.'
        ];
 $VAR2 = '$VAR1 = {
          \'first_name\' => undef
        };
';
[download]

That looks like it works, except this line from the same print_application function: print textfield(-name=>'first_name', -size=>'40', -maxlength=>'40', -default=>"$app{'first_name'}");

returns... <input type="text" name="first_name" value="nameCheckFailsIfNumbersPresent12345" size="40" maxlength="40">

Why is the value "nameCheckFailsIfNumbersPresent12345" present in $app{'first_name'} but not in Dumper \%app or p("Value is", $app{'first_name'}) - all of which are called from inside the function?