Race-safe upgrade filesystem operations and root-cause preservation

Treat upgrade filesystem operations as race-sensitive. Never use the same source and destination path; keep patch intermediates in memory and remove temporary artifacts after failure. Install error handlers before writes, honor backpressure, flush and close resources, and preserve the first operation error over cleanup failures. Verify the emitted binary is a visible, regular, non-empty file at cumulative delays 0/100/300/700/1500/3100 ms, then throw UpgradeError("execution_failed"). Use the required Windows EPERM/EBUSY fallback because rename is not reliably atomic with open destinations.