Make Box replacement recoverable

[BrettKinny]

Closes #108

Summary

• create and provision replacement Boxes under temporary names before promotion
• restore the prior Box, source, image alias, managed configuration, shell integration, and state on handled failures
• add aligned deterministic failure boundaries to Bash and PowerShell plus an ADR separating handled rollback from crash consistency

Validation

• all executable tests/test-*.sh scripts pass locally
• native PowerShell contract coverage runs in the Windows lifecycle CI job