fix(subscription): preserve valid persisted fallback

[Zhanfg]

Background

Persistent http-file / https-file subscriptions are intended to provide a last-known-good fallback when a remote subscription cannot be refreshed.

Previously, a successful HTTP request could overwrite the persisted file before the response was proven to contain usable subscription nodes. An empty, invalid, locked, or otherwise unusable response could therefore destroy the valid fallback.

This change validates fetched subscription content before persistence, falls back to the existing persisted subscription for invalid responses and non-2xx HTTP responses, and replaces valid persisted data atomically using a temporary file and rename.

The persisted file remains mode 0600.

There is partial overlap with #1058, which also contains persistence handling as part of the much larger group-entry-chain feature. This PR intentionally keeps the subscription integrity fix independent and narrowly scoped, and additionally covers non-2xx HTTP fallback behavior.

Checklist

• The Pull Request has been fully tested
• There's an entry in the CHANGELOGS
• There is a user-facing docs PR against https://github.com/daeuniverse/dae

Full Changelogs

• Preserve the last valid persisted subscription when refreshed content contains no usable nodes.
• Fall back to persisted content on non-2xx HTTP responses.
• Atomically replace persisted subscription files only after validation.
• Keep persisted subscription permissions at 0600.
• Add regression coverage for invalid responses, valid replacement, and HTTP error fallback.

Issue Reference

Closes #1076.

Also addresses #1007.

Related: #1058 contains partially overlapping persistence handling inside a larger feature PR.

Test Result

• Focused subscription regression tests passed.
• go test -tags dae_stub_ebpf ./... passed on the fork runner.
• HTTP 503 → persisted fallback regression coverage was added during final review.
• git diff --check passed.