fix: classify lock reads and dispose rejected OpenAPI bodies

[smiggleworth]

A one-shot lock preflight EACCES could be treated as rename contention and admit an update, while rejected OpenAPI downloads could retain streaming response bodies. Keep read and rename error classification separate, and dispose rejected or redirected bodies through the existing cleanup path. Preserve load limits, complete successful responses and the bounded Windows observation retry.

Validation: ten new/strengthened assertions fail against immutable pre-fix source; all 455 unit cases and the main release checks pass locally. A real local HTTPS probe changes five rejected-response cases from one or two live streaming sockets to no live sockets or further body writes. Thirty-five added cases include nineteen malformed-input cases, five real local installer process outcomes, two preflight denials and nine transport cases; one existing transport assertion is strengthened. Packed checks retain two names, reject nine old imports and fifteen private paths under actual TypeScript 6.0.3/7.0.2. Full matrix, source assertions, process-recovery and timeout boundaries are recorded in docs/0.5.0-hardening.md.

All five packed templates, the peer floor, production audit, formatting and 22 unchanged performance gates are qualified separately. Refs #159; closure waits for exact PR and merged checks. No package version, dependency, public surface, workflow or budget changes. The complete candidate graph/site and maintainer full review still gate publication.

The initial Windows run passed the publication assertions but fixture removal hit EBUSY after CLI termination. The test now waits for inherited installer/shell handles to close after stopping its owned installer. The 22-case publication suite, typecheck and formatting pass locally; hosted checks run on the corrected commit. Production source is unchanged by this test correction.