Replace a damaged prepared tool runtime

[lexoliu]

prepare_local treated <root>/<cache key> as prepared as soon as the directory existed, so a runtime with missing executables failed with a pathless Io(NotFound) on every later run (seen in May's CI after a cache tool restored the directories without their files), and an altered one failed with Integrity forever.

• An invalid runtime — an executable missing, not a regular file, with the wrong digest or with writable/non-executable permissions — is replaced by a freshly staged one, then verified once; a second failure is an error, never a retry loop.
• A missing executable is reported as InvalidCache(path).
• Creating or replacing a runtime runs under an exclusive fd-lock lock on <root>/.<cache key>.lock, re-checked after acquisition, so two preparers cannot move aside a runtime the other just installed. A valid runtime is reused without the lock and without writes. (std::fs::File::lock needs Rust 1.89; the workspace MSRV is 1.88.)
• Behaviour change: a tampered runtime is now replaced with a warning instead of failing closed; tampered_cache_fails_closed became the replacement test.

Tests: missing executable reports its path; empty bin/ skeleton, altered bytes and writable executable are each replaced; a valid runtime is reused with inode and mtime unchanged; eight concurrent preparations of one broken root all succeed with nothing left behind. aither-sandbox: 169 passed (with HEEL_BIN), fmt and clippy -D warnings clean.

Closes #131

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 95.53073% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
sandbox/src/tool_runtime.rs	95.53%	8 Missing ⚠️

📢 Thoughts on this report? Let us know!