Atomic promotion & the library

When a run is accepted, its work moves from a private working copy to the library, the durable, global home for finished runs. The move is built so that it is impossible to end up half-promoted.

First a guard: promotion refuses unless the gate's signed marker validates, so nothing reaches the library without passing the gate. Then the working directory is moved into a hidden staging directory (.<run>.promoting/), where the manifest.json is written. Finally, a single atomic rename moves staging to its final home at library/<scope>/<run>/.

Because each step is a rename, a crash at any point is recoverable. On the next attempt, deadreckon detects the half-finished state and finishes it: if only staging exists, complete the rename; if both exist, clean up staging; if the manifest is missing, write it. A run that was already promoted is left untouched.