fix: create update temp files exclusively

[ryanfowler]

Summary

• use random suffixes for update temp file names
• create update temp files with create_new and retry on collisions
• copy update files into already-open exclusive temp handles
• harden can_replace_file probing to avoid truncating existing files

Validation

• cargo fmt --check
• cargo test --locked --all-features --lib update::install
• cargo clippy --locked --all-targets --all-features -- -D warnings