fix: stage retained-tool refreshes before publication

[sylvesterkaczmarek]

Summary

Make the online retained test-tool and release-tool refresh paths build and verify a complete staged tree before replacing the currently valid committed tool tree.

Problem

Both script/vendor-test-tools and script/vendor-release-tools currently remove their existing committed artifact directory near the start of the refresh, before the network-dependent work has completed.

That means a transient fetch failure, checksum mismatch, archive validation failure, or cargo vendor failure can leave the working tree with the previously valid retained tools deleted or only partially rebuilt.

This is different from Fence's safer dependency-update pattern, where replacement data is prepared in a temporary location before the existing generated state is replaced.

Evidence / reproduction

• On the base commit, script/vendor-test-tools creates its temporary directory and then immediately calls remove_generated_path "$test_tools_dir" before fetching either licence file or any of the four cargo-llvm-cov archives.
• On the base commit, script/vendor-release-tools similarly removes vendor/release-tools before fetching the four Zig archives, the cargo-zigbuild crate, generating its lockfile, or vendoring its dependencies.
• Both scripts are intentional online maintenance paths, so fetch and upstream failures are expected operational failure modes rather than impossible states.
• Minimal reproduction for either base path is to make a later fetch fail after the script has passed its initial lock/version checks. At that point the old retained tree has already been removed even though no complete replacement exists.
• The new shared publication helper keeps the previous destination intact until a staged replacement is ready. It temporarily renames the previous tree only during publication, runs the existing retained-tool validator against the published tree, and restores the previous tree if that validator fails.
• script/test-staged-tree covers successful publication, validation failure with a previous tree, restoration of the previous bytes, failure-status propagation, and validation failure when no prior tree existed.

Change

• build downloaded test-tool artifacts and their manifest entirely under the temporary staging root
• build downloaded/generated release-tool artifacts, archives, lockfile, and manifest entirely under the temporary staging root
• add one shared staged-tree publication helper
• publish only after all network downloads, checksums, archive checks, and cargo generation have completed
• run the existing validate-test-tools / validate-release-tools check after publication
• restore the previous retained tree automatically if final validation fails
• run a focused offline staged-publication regression from the normal script/test entrypoint

No retained tool versions, lockfiles, source URLs, checksums, archive formats, or successful refresh outputs change.