(engine) Make multi-file rename application transactional

[tcballard]

Priority

P2 — corpus integrity during mutation.

Problem

Multi-file rename --apply validates and writes one file at a time. If a later file is stale or its write fails, earlier files remain changed while the command returns an error. This can leave identity and inbound references out of sync.

Evidence

• Sequential validate/write loop
• Stale-plan failure after earlier writes are possible
• Documented atomic-semantics expectation

Acceptance criteria

• All affected files are read, checked for staleness, and rendered before any corpus file is replaced.
• Replacements are staged as sibling temporary files.
• Commit/replacement failure cannot leave a silently partial rename.
• Recovery or rollback behavior is deterministic and documented.
• Error-injection tests cover stale plans, permission failures, and replacement failures after staging.
• Successful application still produces a corpus that passes validation.

Blocked by the root-confinement fix: filesystem safety should land before transactional mutation is expanded.