fix(cli): recover agent context when run-state.json is torn

[nordicnode]

Summary

Companion to the compaction wipes in #1166 — this is the persistence-side path to the same "model lost all chat history" symptom (details and repro in #1168). A resumed chat could start amnesiac through a chain with no single point of failure:

• writeFileAtomic/writeFileAtomicAsync now fsync the temp before renaming. Without it, a power loss could land the rename while the data blocks were never written — a torn run-state.json exactly where the atomic rename was supposed to guarantee a complete file.
• loadMostRecentChatState recovers instead of giving up. On an unreadable primary it now tries the rotated run-state.json.bak (previous complete generation; each synchronous save rotates the current file aside before overwriting), then the newest complete checkpoint .tmp (left behind when a process dies between write and rename), self-heals the primary from whichever recovered, and only falls back to the context-less placeholder when all three are unreadable.
• The loss is surfaced, not silent. loadMostRecentChatState returns runStateRestored, and the resume flow prepends an error-variant notice ("the assistant starts this chat without memory of earlier turns; the transcript below is intact") when it is false. Previously the transcript rendered normally and the model just "forgot" — indistinguishable from a broken assistant.
• The async rename retries briefly on EPERM/EBUSY/EACCES. On Windows the just-closed handle can still be held by AV/indexer scans — a transient the fsync widens the window for. Bounded (4 retries, exponential backoff), non-matching errors rethrow immediately.
• clearChatState also removes the .bak.

Validation

• bun test cli/src/utils/__tests__/run-state-storage.test.ts cli/src/utils/__tests__/write-file-atomic.test.ts cli/src/utils/__tests__/chat-meta.test.ts cli/src/utils/__tests__/safe-json.test.ts (75 pass) — 6 new recovery tests: .bak recovery + self-heal, newest-temp recovery, healthy primary flagged restored, all-three-unreadable fallback with the loss flagged, backup rotation on save, backup cleanup
• The placeholder-without-sessionState → amnesia chain reproduced with a temp-dir test before the fix; the recovery tests fail on the pre-fix loader
• Full CLI suite: identical failures with and without this change (20 pre-existing env-dependent failures + 12 pre-existing import-chain errors on main; this change adds 6 passing tests, breaks nothing)
• bunx tsc --noEmit -p cli/tsconfig.json — no new errors (10 pre-existing, all in unrelated test files: missing tar types, react-dom/server types)

Refs #1168