Implement atomic run bundles and complete-bundle retention policies

[codeforester]

Parent: #50

Train position: 12 of 22
Phase: P2 — Operational completeness

Problem

Metadata writes are not a complete atomic storage contract, and retention prunes individual logs rather than bounded invocation bundles.

Acceptance criteria

• Metadata and indexes use same-filesystem temporary writes, flush/sync where appropriate, atomic replacement, and symlink-safe operations on supported platforms.
• Concurrent writers cannot corrupt run state or retention indexes.
• Retention applies to complete run bundles by configurable count, age, and total size, with safe defaults.
• Active, inherited, and explicitly preserved bundles are never removed; stale-running crash recovery is defined.
• Concurrent, pruning, crash, and write-failure tests prove deterministic bounded behavior.

Dependencies

• Finalize run metadata and normalize every invocation outcome #52
• Harden sensitive-option redaction and runtime cleanup boundaries #54