docs(audits): io_uring RENAMEAT2 wiring sites

[oferchen]

Summary

• Inventory every fs::rename call in crates/transfer/src/disk_commit/ and crates/engine/src/local_copy/executor/ (4 sites total).
• Document each site's current syscall, error handling, retry semantics, and frequency.
• Cite the RENAMEAT2 + kernel-probe primitive shipped by PR feat(fast_io): add io_uring RENAMEAT2 wrapper and kernel probe #3739 (closes Accelerate sparse writes with SIMD-aware zero detection #1920, Fix interop script temporary directory initialization #1922) at crates/fast_io/src/io_uring/renameat2.rs.
• Cost/benefit per site: only the disk-commit commit_file rename clears the bar, and only as the chained tail of an existing IOSQE_IO_LINK chain behind IORING_OP_FSYNC.
• Conservative wall-clock estimate: 1-3% of disk-commit thread time on small-file workloads with --fsync.

Closes #1924.

Test plan

• Documentation-only change; no runtime impact.
• Reviewer verifies the four rename call sites match the grep.
• Reviewer confirms PR feat(fast_io): add io_uring RENAMEAT2 wrapper and kernel probe #3739 (commit 9086f7f78) is the correct citation for the RENAMEAT2 primitive.