Publish blueprint sites transactionally

[Deicyde]

Moved from #35. Its head branch lived on VivienCabannes/autoform-bot, which is being deleted, so this PR uses the same-named branch in facebookresearch/autoform-bot (same commits, head aa789e4). Earlier review and discussion are on #35.

---

Summary

• render from bounded immutable blueprint and Lean snapshots into a frozen file plan
• materialize through retained directory descriptors with no-follow, exclusive writes
• install new sites atomically and replace owned sites with one verified exchange
• fsync staged files and every newly created output-parent generation
• track exact publication inventories for safe cleanup and truthful recovery reporting
• reject source, stage, destination, and parent-generation changes without rollback after commit begins

Depends on #28. The reviewable change is commit aa789e4; earlier commits belong to the dependency stack.

Validation

• Python 3.13 full suite: 714 passed, 4 skipped
• Python 3.10 full suite: 715 passed, 3 skipped
• final independent focused review: 226 passed
• make lint
• make check-example
• sdist, wheel, and clean installed-CLI smoke
• git diff --check
• independent exact-diff review: SHIP

[Deicyde]

#73 should not be refreshed or merged as-is. Its snapshot prerequisites landed via #95, but the atomic output transaction remains genuinely unmerged; current render_site still deletes/writes the live destination in place.

Rebuild from repaired local candidate dc80ef23, not stale head aa789e4. Preserve current open/conditional status rendering, container behavior, dashboard Host/Origin guards, dual path/article claim targets, runtime fields, and #95 snapshot APIs when resolving its four current-main conflict files. #145 is complementary: verification should gate Pages first, while transactional render protects the generated site tree.

One human-visible decision is required: dc80ef23 intentionally makes render unavailable outside Linux renameat2 / macOS renameatx_np, including Windows, whereas main currently renders on Windows. Either approve/document that capability boundary or design a safe portable transaction. Then run current CI plus recovery/fault and workflow integration tests, open the clean replacement, and close this stale 8K-line branch as superseded. Existing green checks do not validate the repaired/current-base code.

[Deicyde]

Superseded by #165, rebuilt from repaired dc80ef23 on current main with all current status/container/dashboard/claim semantics preserved. The replacement adds explicit filesystem capability probing, Windows fail-before-write behavior, process-exit recovery, exact recovery paths, serialized dashboard claim reads, and snapshot-policy ABA protection; independent review is clean and 434 touched-surface tests pass.

Closing this stale pre-#95 branch so review happens on the focused current-base implementation.