fix: make mirror publication crash-recoverable

[xxvcc]

Summary

• Commit missing immutable mirror files with Linux renameat2(RENAME_NOREPLACE) and recover only strictly validated private temporaries or the exact legacy two-hard-link state.
• Make directory, temporary, stage, and lock creation independent of the process umask; repeat the version-parent fsync on retries and keep every existing release byte create-only.
• Apply the v2 floor consistently, preserve arbitrary-precision version ordering, and require a real no-replace probe on the production document-root filesystem before installing the receiver.

Testing

• go build ./...; go vet passes with ordinary tags; integration-tag Go code is unaffected
• gofmt -l . is empty (no Go source changed)
• Ordinary and race tests pass
• Integration and integration-race behavior is unaffected; this change is limited to the mirror receiver and release documentation
• Go static analysis and vulnerability surfaces are unaffected; go vet, go mod verify, and go mod tidy -diff pass

Release/install scripts, if changed:

• bash -n scripts/*.sh, sh -n scripts/install.sh, and shellcheck -S warning scripts/*.sh
• PYTHONINTMAXSTRDIGITS=0 PYTHONDEVMODE=1 PYTHONWARNINGS=error::ResourceWarning python3 -B -m unittest -v scripts/mirror_receiver_test.py (22 tests)
• Invalid version/tag rejection passes; static amd64/arm64 Go build behavior is unaffected

Workflows, if changed:

• actionlint (workflow files are unchanged)

Documentation, if changed:

• User-facing Chinese and English documents are unaffected; release-operator documentation and relative links remain consistent

Safety Notes

• No real private keys, invite bundles, hostnames, server IPs, account database data, or production authorized_keys were committed.
• User/account/sudoers/systemd behavior is not affected. Mirror mutation remains serialized by the persistent deployment lock and fails closed when no-replace support or recovery metadata is unexpected.