Durable orphan naming for publish_staged_tree double failure (#29 slice 1)

[jon-devlapaz]

What changed and why

On publish+rollback double failure, rollback_or_retain_backup (used by skills::publish_staged_tree) now renames the displaced original tree from staging/old to a durable path beside the destination root:

.tink-orphan-<skill-name>-<pid>-<nanos>

The error message names that orphan path. The temp staging directory is dropped when the orphan move succeeds. If the orphan rename itself fails, behavior falls back to the prior TempDir::keep() recovery under the temp prefix.

This addresses the first #29 slice: operators no longer need to hunt inside .tink-update-* / .tink-promote-* staging dirs for the original tree after a double failure. All existing callers (replace_verified, library promote, skillset replace) pick up the behavior automatically.

Happy-path publish and single-failure rollback are unchanged.

How to prove

cargo test rollback_failure_retains_recovery_backup_at_durable_orphan_path -- --nocapture
cargo test publish_staged_tree_restores_target_when_publish_fails -- --nocapture
cargo test --workspace --all-targets --locked
cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings

Key tests:

• skills::tests::rollback_failure_retains_recovery_backup_at_durable_orphan_path — double failure leaves bytes at .tink-orphan-* and error names it
• skills::tests::publish_staged_tree_restores_target_when_publish_fails — single failure rollback restores live tree; no orphan dirs left

Docs: docs/RELIABILITY.md (orphan naming), docs/TESTING.md, docs/issue-29-verification-spike.md (status refresh).

What remains on #29

• Shared helper unification across publish_staged_tree, manifest::write_atomic, and update::replace_binary
• Durable orphan naming for manifest/binary paths (still temp-prefixed)
• library::deposit_at divergent clear_path repair
• End-to-end double-failure injection through full rename window (no concurrency hooks)

Do not close #29 with this PR.