AtomicFileWriter should make permission application and durability failure behavior explicit

[Widthdom]

Found while dogfooding the current source with the locally built cdidx.

AtomicFileWriter handles temp-file replacement, but post-move permission application and directory durability are weak points. If permission application fails after replacement, callers can observe a replaced file with unexpected mode. Parent directory fsync is also not documented or performed, so crash durability guarantees are unclear.

Evidence:

• src/CodeIndex/AtomicFileWriter.cs moves the replacement into place before applying the requested mode.
• The helper does not appear to fsync the parent directory after rename.

Suggested fix: define the intended atomicity/durability contract, apply permissions before rename where possible, handle post-rename failures explicitly, and fsync the parent directory on platforms where that is supported.

[Widthdom]

I’m starting work on this in branch fix-issue3409-3463-3464.