fix(marketplace): prevent corrupt registry data loss

[christso]

Summary

Marketplace registry reads now fail loudly when marketplaces.json is corrupt or unreadable, so later mutations cannot persist an empty fallback over existing registrations. Registry saves stage complete JSON in a unique same-directory file, restore the existing file mode, and atomically rename it into place; failed replacements clean up the staged file and leave the live registry unchanged.

Only ENOENT represents an absent registry. This change does not add backups or cross-process locking; concurrent writers retain last-writer-wins semantics, but readers can no longer observe an in-place truncation.

Closes #465

Verification

Automated checks:

bun test tests/unit/core/marketplace-scope.test.ts
bun run build
bun run typecheck
bun test
bun run lint

Focused result: 30 tests passed. Full result: 1,491 passed, 5 skipped, 0 failed across 137 files.

Built-CLI E2E:

REPO="$PWD"
E2E="$(mktemp -d -p /tmp allagents-465-green.XXXXXX)"
mkdir -p "$E2E/workspace/.allagents" "$E2E/home" "$E2E/m1" "$E2E/m2"
printf 'version: 1\nplugins: []\n' > "$E2E/workspace/.allagents/workspace.yaml"

cd "$E2E/workspace"
HOME="$E2E/home" "$REPO/dist/index.js" plugin marketplace add "$E2E/m1" --name m1 --scope project
truncate -s 0 .allagents/marketplaces.json
HOME="$E2E/home" "$REPO/dist/index.js" plugin marketplace list --scope project
HOME="$E2E/home" "$REPO/dist/index.js" plugin marketplace add "$E2E/m2" --name m2 --scope project
stat -c %s .allagents/marketplaces.json
cd "$REPO"
rm -rf "$E2E"

The first add succeeded and left no temporary registry file. After truncation, both list and the second add exited 1 with Marketplace registry ... is unreadable and the refusal-to-overwrite guidance. The final size remained 0, proving the corrupt bytes were not replaced.