fix: guard generated directory ownership and recovery

[smiggleworth]

OpenAPI generation could restore a partly deleted backup after cleanup failed, losing both complete output trees. Route it through the shared recoverable directory publication routine, clean partial stages, preserve filesystem errors and report retained stages if cleanup fails. Project creation now rechecks destination ownership under the publication lock, preventing concurrent creates or recovered output from being overwritten, and prints success only after publication.

Validation: the complete new 17-case matrix produces 12 failures and five passing controls against immutable pre-fix source. All 372 tests and main release checks pass locally, including child termination at three publication checkpoints, partial backup deletion, rollback/stage cleanup failures, junctions/permissions, deterministic concurrent creation and package-manager result injections. Packed checks exercise two retained names, nine rejected imports and 14 private paths under actual TypeScript 6.0.3/7.0.2. OpenAPI loading, validation and generated-file rendering bodies are byte-identical to the accepted base. Templates, peer-floor, audit and all unchanged performance gates are checked separately.

Refs #159; remaining malformed-input and actual subprocess/cancellation probes still gate closure. Parent Vitest coverage is 85.43% statements, 78.11% branches and 87.18% lines; forked fault-case coverage is not included in those percentages. No package versions, dependencies, workflows or budgets change. Process checkpoint recovery does not establish power-loss durability. Full candidate graph/site qualification and maintainer review gate publication.