Preserve installed plugin when cancellation wins before publish

[Blackspirits]

Summary

Plugin installation currently has cancellation checks after deleting the existing installed plugin and again before moving the replacement into place. Cancellation can therefore win after the destructive delete and leave the user with no installed copy.

This change:

• makes the replacement commit point explicit
• honors cancellation before any destructive publish operation
• once replacement begins, finishes publishing the already-downloaded/unpacked plugin instead of observing cancellation mid-commit
• preserves the existing temp-download/unpack flow, catalog lookup, target naming and cleanup behavior
• adds regressions proving cancellation-before-commit preserves the installed plugin and normal replacement still publishes the new plugin

Validation

• current upstream still contains the destructive delete → cancellation-check ordering
• this patch changes only the publish transition and its regressions
• plugin ZIP checksum/signature metadata is intentionally out of scope: the current online index schema provides platform download URLs but no digest/signature field, so integrity hardening requires a coordinated index/schema change rather than invented local hashes
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34721272791

Base is upstream fa6d8623c2adb0c646b6d31a11b221b855339bbe.

This PR supersedes internal draft #16.

AI assistance: ChatGPT was used to independently re-audit the plugin install state transition on current upstream, isolate the destructive cancellation window, port the commit-point fix, and add regression coverage.

[Blackspirits]

Independent adversarial re-check on current upstream base: the original destructive delete → cancellation-check ordering is still present in upstream; this patch moves the cancellation gate to the explicit publish commit point and deliberately stops observing cancellation after replacement begins, preventing a cancelled install from deleting the existing plugin without publishing the new one. Focused regressions cover cancellation-before-commit and normal replacement. Full current-base CI run #34721272791 passed restore/build/full tests on the first run with no retry. No blocker identified. Keep draft; no merge/promotion performed.