Improve FileStore read/write safety

[satyakigh]

1. Atomic writes via write-to-temp-then-rename (EncryptedFileStore.ts)

Both save() and saveSync() now write to a temporary file (..tmp) first, then atomically rename it to the final path. Previously, writeFileSync/writeFile wrote directly to the target file.

Why it's needed: If the process crashes or is killed mid-write, a direct write can leave a truncated/corrupted file on disk. The rename operation is atomic on most filesystems — the file either has the old content or
the new content, never a partial state. This prevents data loss in the encrypted file store.

2. Guard against use-after-close (FileStoreFactory)

A closed flag was added to FileStoreFactory. Three methods now check it:

• close() — becomes idempotent (safe to call twice)
• emitMetrics() — no-ops if closed, preventing telemetry calls after shutdown
• cleanupOldVersions() — no-ops if closed, and also checks existsSync(this.fileDbRoot) before reading the directory

Why it's needed: The factory sets up setInterval (metrics) and setTimeout (cleanup) timers in the constructor. If close() clears these timers but a callback was already queued on the event loop, it could fire after
close and hit errors (e.g., accessing a deleted directory or emitting metrics on a torn-down telemetry instance). The closed guard prevents that race.

3. Lock acquisition moved earlier in constructor recovery path (EncryptedFileStore.ts)

The file lock is now acquired before readFile() in the constructor, not just around the saveSync() fallback. The old code only locked when it needed to recreate a corrupted store; the new code locks for the entire read-
then-maybe-recover block.

Why it's needed: Without the lock around readFile(), another process could be writing to the file concurrently while this instance reads it, leading to a read of partially-written data. By holding the lock during the
entire constructor initialization, the instance gets a consistent snapshot of the file.

[Zee2413]

What's this improving and fixing? Commit message should be more detailed.