Make library divergent deposit repair restore-or-orphan safe (#29)

[jon-devlapaz]

What changed / why

library::deposit_at on PreflightOutcome::Divergent previously called clear_path then install_local. If install failed after the clear, the only library copy was gone with no recovery path — a #29-class gap distinct from refresh replace (which already uses restore-or-keep via publish_staged_tree / #70).

This PR replaces that path with repair_divergent_deposit: stage the incoming tree beside the library (.tink-deposit-*), then publish via skills::publish_staged_tree. On publish failure the live tree is restored; on double failure the displaced original is renamed to .tink-orphan-<skill-name>-<unique> beside the library root and the error names that path.

Success semantics are unchanged: divergent repair still reports LibraryWrite::Repaired.

Proof commands + test names

cargo test deposit_diverg -- --nocapture
cargo test --workspace --all-targets --locked
cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings

Test	Proves
library::tests::deposit_diverge_repairs	Divergent repair success; reports Repaired and replaces body
library::tests::deposit_divergent_repair_restores_original_on_publish_failure	Publish failure after live displacement restores original library bytes
library::tests::deposit_divergent_repair_retains_orphan_on_double_failure	Double failure leaves .tink-orphan-demo-skill-* beside library root; error names path

What remains on #29

• Shared helper unification across publish_staged_tree, manifest::write_atomic, and update::replace_binary
• Durable .tink-orphan-* naming for manifest/binary paths (tree swap already uses it)
• First-install-only staging drop-risk (install_local Ready path)
• Closing Refactor: durable atomic skill-tree swap (shared helper) #29 is intentionally deferred until consolidation scope is addressed