fix: clean up partial build and publish failures

[jmgilman]

Summary

• remove newly-created IncusOS outputs after later variant build failures
• reject pre-existing output paths before build to avoid unrecoverable overwrites
• delete draft imgsrv artifacts after safe pre-publish AddArtifact cleanup points
• avoid cleanup after PublishVersion because server state is ambiguous once the POST is sent

Verification

• proto run go -- test -count=1 ./internal/providers/incusos ./internal/publish ./internal/cli
• proto run go -- test -count=1 -tags integration ./cmd/imgcli
• moon run root:check --summary minimal
• git diff --check master

Stacked on #21.