Fix recoverable manifest startup race

[bordumb]

Outcome

Concurrent gateway startup can no longer observe a partially written recoverable-development manifest.

Root cause

The first process created the final manifest path before writing and syncing its bytes. A losing process could see that path during the write window, read an empty document, and fail JSON parsing. The protected AWS atomic replay run reproduced this under real process contention: auths-dev/auths-field-lab run 31745824077.

Fix

• write and sync each candidate manifest at a private temporary path
• publish the completed file with an atomic, non-overwriting hard link
• let losers read only the fully published final inode
• remove every losing candidate
• cover 100-way startup contention in TypeScript and Python

The final manifest remains mode 0600; corrupt completed manifests still fail closed.

Validation

• TypeScript build passes
• Python lint and formatting pass
• authoritative cross-platform/package validation delegated to CI