feat: persist RootFS promotion state

[jacklv-coder]

Summary

• flush the extracted RootFS candidate leaf-first and durably persist promotion journal/current records
• synchronize rename parents in destination-first order and recover deterministic interrupted states
• support permission-restricted archive entries and cleanup while preserving their final modes
• require a caller-created base directory and document the single-process concurrency contract
• add the seven-checkpoint persistence failure matrix plus journal-only and candidate-with-backup power-loss cases

Validation

• swift test — 137 tests, 1 expected environment-gated skip, 0 failures
• strict-concurrency build with warnings as errors
• pinned v0.3.3 RootFS release-asset integration test
• bilingual docs/link validation and shell syntax checks
• demo Simulator build and iSH runtime Simulator/device compile spike
• Codex CR: no actionable findings; P1/P2 = 0

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c64361c4d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".