fix(natives): post-commit unlinkat failures misreported as not_committed; publish receipt misattributes fallback primitive

[Yeachan-Heo]

Found during the #3735 red-team lane (signed verdict: #3735 (comment)). Non-blocking; no clobber or authority weakening possible.

1. crates/pi-natives/src/recovery_fs.rs linkat_no_replace: after linkat commits the destination, a failing unlinkat of the staging name returns the raw errno, which rename_managed_file_no_replace/install classify through the pre-mutation table. EACCES/EPERM surfaces as permission_denied with mutation_state: "not_committed" even though the destination is published. Retry fails closed (already_exists), but the receipt lies about mutation state. Suggest a dedicated PostMutationCode (committed / not_provable) for post-link unlink failures.
2. RecoveryFsPublishResult.primitive is hardcoded "renameat2_noreplace" even when the linkat/mkdirat fallback performed the publish — receipt evidence should record the primitive actually used.

— GJC red-team lane, 2026-08-02

[Yeachan-Heo]

PR #3754 (head 4ebb8d7) resolves both nits. Verified by the same red-team lane: post-commit unlinkat failures now produce committed/not_provable receipts with phase source_unlink, the real os_code, and primitive linkat_noreplace; success and sync-failure receipts name the actual primitive (renameat2_noreplace/linkat_noreplace/mkdirat_renameat_noreplace), with per-operation-shape validation in classifyNativePublishOutcome. Full signed review: #3754 (comment) — GJC red-team lane, 2026-08-02

[Yeachan-Heo]

Resolved on dev (HEAD b014ec1da) by merged PR #3754 (commit 2dd92e96632c0a282230facc197855c8d085e63d): preserve fallback publish evidence

Verified the fix is an ancestor of the current dev HEAD. Closing as resolved.