Durable orphan naming for manifest and binary replace paths (#29)

[jon-devlapaz]

What changed / why

Issue #29 residual: tree replace already renames displaced originals to .tink-orphan-* on double failure (#70). Manifest (manifest::write_atomic) and binary (update::replace_binary) still retained recovery artifacts under temp prefixes (.skills-manifest-backup-*, .tink-backup-*) via keep().

This PR aligns file replace paths with the tree safety story:

• On rollback failure after displacing the live manifest or binary, the recovery backup is renamed beside the destination root to .tink-orphan-<file-name>-<unique>.
• Error messages name that durable path (recovery backup: …).
• keep() is used only when the durable orphan rename fails.
• Shared helpers live in paths::orphan_recovery_path and paths::move_file_to_orphan; skills::rollback_or_retain_backup now reuses the naming helper.

Happy path and successful single-failure rollback leave no durable orphans (existing + extended characterization tests).

Proof commands + test names

cargo test --lib write_atomic_retains_orphan_on_double_failure -- --nocapture
cargo test --lib write_atomic_restores_manifest_when_lock_publish_fails -- --nocapture
cargo test --lib replace_binary_retains_recovery_backup_when_rollback_fails -- --nocapture
cargo test --lib replace_binary_rolls_back_when_published_probe_fails -- --nocapture
cargo test --lib rollback_failure_retains_recovery_backup_at_durable_orphan_path -- --nocapture
cargo test --workspace --all-targets --locked
cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings

What remains on #29

• Shared swap helper unification across publish_staged_tree, write_atomic, and replace_binary (explicitly out of scope for this PR).
• First-install-only staging paths and other non-replace call sites noted in docs/issue-29-verification-spike.md.

#29 should stay open until the shared-helper consolidation slice is tracked/landed separately.

Fixes the manifest/binary durable-naming slice of #29; does not close #29.