fix(manifest): harden v0.6.0 canonical writes and MSRV

[Fieldnote-Echo]

Stacked on #297 so every review surface consistently targets the corrected 0.6.0 train. Retarget to main after #297 merges.

What changed

• write manifests to a synced same-directory temporary file, then atomically replace the destination
• preserve File::create mode/umask behavior for new Unix files and portable permissions for existing files
• reject symlink and other non-regular destinations before replacement
• reject non-finite distortion values before touching an existing manifest
• recursively sort nested extension/attestation maps before serialization
• normalize exactly representable JSON numbers and fail closed on precision that would alias through f64
• reject non-UTF-8 artifact paths instead of embedding a lossy replacement character
• restore rusqlite 0.39 because the 0.40 build dependency does not compile on the declared Rust 1.89 floor
• run the manifest all-features suite permanently in the MSRV lane

Why

The manifest bytes are the bundle's content address. In-place truncation, feature-dependent JSON ordering, lossy paths, silent NaN-to-null conversion, and precision collisions all weaken that identity contract. Separately, the dependency bot's SQLite bump silently broke ordvec-manifest --all-features on the documented MSRV.

The numeric path deliberately rejects values outside the exact canonical i64/u64/f64 domain instead of collapsing distinct arbitrary-precision inputs to the same bytes.

Validation

• adversarial independent review: SHIP after collision and permission-contract fixes
• stable ordvec-manifest --all-features: 121 passed
• Rust 1.89 ordvec-manifest --all-features --locked: 121 passed
• no-default-features: 101 passed
• clippy all-targets/all-features with -D warnings
• release publish and signed-release invariant suites
• cargo deny, fmt, and diff checks

Closes #294.
Closes #295.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!