Write every utils::fs atomic file through one stage-and-rename core (#728) (#858)

* Start refactor for #728

Assisted-by: Claude Code:claude-opus-5-5

* Share one stage-and-rename core in utils::fs

Every atomic file write (lockfiles, manifests, vendored artifacts,
group-commit replays) now goes through one blocking core that owns the
stage name, the stage's creation mode, the fsync, the
set-mode-then-rename order and the unlink on failure. The async
writers run it on the blocking pool, and the blob cache builds its
.socket-dl- stage name through the same helper. A hardening fix to the
write path now lands once instead of twice.

No behavior change: the same bytes, modes, fsyncs and stage names.

Refs #728

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: mikolalysenko <mik@socket.dev>

Author: 3 people

crates/socket-patch-core/src/api/blob_fetcher.rs

@@ -424,10 +424,6 @@ async fn stream_cache_entry_atomic(
             "cache entry path has no parent directory",
         ))
     })?;
-    let stem = dest
-        .file_name()
-        .map(|n| n.to_string_lossy().into_owned())
-        .unwrap_or_else(|| "blob".to_string());
     // The cache directory (`.socket/blobs/`, `.socket/diffs/`) is created
     // here, by the first download, and nowhere earlier. A fetch that lands
     // nothing (all 404, offline, every hash mismatched, every body cut
@@ -442,9 +438,7 @@ async fn stream_cache_entry_atomic(
         }
         created_dirs.push(dir);
     }
-    // Leading dot keeps the stage out of editor/glob views; the uuid suffix
-    // keeps concurrent writers of the same entry from colliding.
-    let stage = parent.join(format!(".socket-dl-{}-{}", stem, uuid::Uuid::new_v4()));
+    let stage = crate::utils::fs::stage_path(dest, ".socket-dl-");
 
     let result = async {
         // Inside the cleanup scope: a `create_dir_all` that makes some