Make Box replacement recoverable across late lifecycle failures

[BrettKinny]

This was generated by AI during triage.

Type: HITL

What to build

Deepen the post-v1.1 rebuild transaction so a late checkout, image-alias, Box creation, provisioning, or state-publication failure can restore a runnable prior installation instead of only leaving a safe retry path. Workspace and Managed-home data are already preserved; this issue covers disposable Box availability and source/image/state coherence.

Acceptance criteria

• Model the lifecycle transaction and define the commit point for checkout source, image alias, Box identity, configuration, and Install identity.
• Create and validate the replacement under temporary names before removing or renaming the prior Box wherever the runtime permits.
• Preserve the original failure status and diagnostics if rollback or cleanup also fails.
• Restore the prior source revision, image alias, Box, and state together, or report a precise recovery command when a runtime cannot provide an atomic swap.
• Never roll back, copy, or delete Workspace or Managed-home user data.
• Add deterministic failure injection at every mutation boundary for Bash and PowerShell adapters, including custom names and an unreachable runtime.
• Document crash consistency separately from handled-error rollback and record the design in an ADR.
• Re-run Linux Docker, rootless Podman, macOS, and Windows lifecycle qualification after implementation.

Blocked by

• Qualify the v1.1 Candidate on physical amd64 and arm64 #105