Harden legacy lane rename handoff publication against process crashes #158

Legacy rename-lane still stamps its handoff with a direct redirect after proving the splice (lanes-edit.sh, the Rule 3 RENAMED stamp). Its existing EXIT rollback restores the four-file transaction on handled failures, but a process crash or power loss during that redirect can leave a partial handoff before rollback runs.

This predates PR #121. That PR now shares the writer mutex with restart publication and refuses unfinished/failed restart ownership before rename. It explicitly scopes atomic publication to restart preservation and resume stamps; ordinary rename's crash durability remains separate.

Harden the individual handoff publication with an exclusive same-directory temporary file and atomic replacement of the resolved target while retaining the existing splice proof, symlink behavior, mutex and rollback bookkeeping. Assess broader four-file crash recovery separately rather than claiming that a single atomic stamp makes the entire rename crash atomic.

Validate with sandboxed write/replace faults and interruption tests that preserve the canonical handoff bytes and existing rollback behavior. Do not use real lane data or real GitHub test repositories.

Source: post-cap Copilot discussions on PR #121, recorded under the 2026-09-16 two-round ruling in AGENTS.md. This follow-up does not release #121's existing merge hold.