fix(backup): complete configuration checkpoints on Windows

[jackie-cqz]

Goal And Delivered Outcome

• Outcome basis: reproduced Windows configuration-backup defect; direct bug-fix PR.
• Gap: CLI export publishes its JSON but reports WinError 32 while unlinking an open temporary file. Restore preview succeeds, but execution fails with EPERM when renaming a staged directory onto a reserved empty directory.
• Result: close and fsync the UTF-8 export before exclusive hard-link publication; publish a complete restore directory with the platform's exclusive rename behavior. Repeated/concurrent operations cannot replace an existing checkpoint.
• Intended base: main at 37b77d4aff1e1e9faa14487888c055c99482c43e.

Author Declaration

• Written by: model_agent (Codex, OpenAI GPT-6).
• Specification: docs/reference/configuration-backup.md at the base revision; the reproduced Windows failures are the repair basis.

Criterion	Disposition	Owner / evidence
Preserve complete configuration and UTF-8 values	implemented	Existing configuration-backup CLI and TypeScript checkpoint owner; native CLI export/verify/restore and HTTP readback
Preview performs no recovery; reviewed digest and physical destination required	implemented	Real HTTP bad-digest/no-write case, TS junction/dangling/occupied target tests
Recovery does not activate live settings or replace a checkpoint	implemented	Source bytes unchanged; two competing restores have one winner and complete readback

Scope And Continuation

Complete for configuration-only export and isolated restore. Placement stays in the existing TypeScript IO owner and Python CLI adapter. POSIX keeps the exclusive directory reservation; Windows uses absent-target directory rename. No new capability, vocabulary, configuration switch or activation authority. The bounded refactor review found no useful additional extraction.

Validation

• Native Windows: Python 3.13.5, Node 24.15.0; CLI file locale explicitly CP936 (PYTHONUTF8=0), captured output UTF-8. Six configuration-only Python tests and five TS tests pass.
• Linux: isolated Python 3.11 / Node 24 source checkout; 33 tests pass across configuration backup, machine configuration contract and HTTP settings. Five real TS checkpoint/concurrency tests pass.
• Packaged frontend: configuration-backup browser scenario passes against a real disposable Python HTTP backend: download, verification, checkpoint recovery/readback, bad digest and mobile layout.
• Ruff, mypy, control-plane TypeScript typecheck, diff advisory and full semantic smoke pass.
• Final revision: 81bffb689c0ae3fd4eb90d21d647db74856c7c62. Windows tests were rerun after the final test-helper encoding adjustment; Linux/browser runs preceded that Windows-only helper adjustment. Runtime and frontend sources are identical.
• Input classes: synthetic. Run state: finished.

Known separate baseline failures: Windows full backup-state tests fail at state_backup.py read-only-descriptor fsync (EBADF), independently reproduced on unchanged main; this PR does not qualify that workflow. The docs navigation smoke and maintainability ratchet also fail on unchanged main (missing getting-started navigation and the Lark goal-topic module budget). Windows ACL enforcement, provider promotion and destination-machine activation are not certified by these tests.

Functional/static test results above preceded the last docs/inventory-only base update; runtime sources, tests and dependency declarations are unchanged. Full semantic validation was rerun on the final rebased revision.

Frontend / Visual Evidence

UI impact: none. The existing Settings → Capability Center backup workflow is exercised with the real backend; no presentation or activation behavior changes.

Boundary Checklist

• Public-safe source, fixtures and validation summary; no private state, credentials, raw logs or machine paths.
• Focused runtime/adapter bug fix with no benchmark work.
• Each commit includes a DCO sign-off.