Fix atomic benchmark result publication

[AlexU-A]

Summary

• publish each benchmark result as one privately staged directory via an atomic no-replace rename
• preserve any concurrently appearing file, directory, or symlink at the canonical destination
• fail closed when the native primitive is unavailable and retain unpublished diagnostic evidence without a success marker on handled failures
• strip and verify inherited macOS ACLs before writing payloads

Security invariant

A successful canonical bundle appears with report.md, manifest.json, and COMPLETE together. Publication never replaces an existing destination. Handled failures leave the canonical name free and remove COMPLETE from retained staging evidence.

Validation

• coverage run -m unittest discover -s tests -v — 54 passed
• coverage report --fail-under=80 — 87%
• python3 scripts/verify_no_copied_skills.py — passed
• committed-blob bootstrap python3 scripts/run_benchmark.py --help — passed
• native Darwin destination-type, concurrent-publisher, and inherited-ACL regressions — passed

GitHub Actions is expected to provide the native Linux renameat2(RENAME_NOREPLACE) execution check.

Boundaries

This does not claim crash durability, protection against an arbitrary malicious same-user process replacing staging or ancestor paths, or independent publication witnessing. A marker-removal failure caused by a filesystem-wide write failure is reported explicitly.

Follow-up to #2, which was merged with the publication race still documented as unresolved.