Store complete packages atomically in the mxpak cache

[GG-O-BP]

Summary

• mendraw#12 reported that partially extracted classic-widget caches were treated as valid. The mxpak successor had the same defect class: store.put wrote directly into the final hash directory and store.has trusted directory existence, so interrupted writes later restored incomplete packages and silently dropped widget bindings.
• Package stores now build in a unique temp directory, write a manifest.mxpak after all entries, atomically rename into place, and replace pre-existing incomplete directories.
• cache.has_package verifies the manifest plus original.mpk; the downloader uses it for cache hits, and project restore excludes both internal files.
• Also repairs a test-comment ordering issue from Lock corrupted ZIP directory offsets to explicit errors #7 that triggered workspace style warnings.

Fixes glendix-labs/mendraw#12

Verification

• gleam test — 118 passed.
• ./scripts/verify.sh inner mxpak — passed.
• ./scripts/check-all.sh — passed.
• pre-push verify.sh final — passed (family checks, widget build, Lustre E2E, Mendix full E2E).