fix: retry transient Windows atomic renames

[Wibias]

Part 7 of 7 — opencodex hardening stack. Base: main. Stacks on Parts 1-6 — merge those first (it rewires the atomic write introduced in Part 1). Focus commit: 6c2eba4.

Summary

Makes atomic config/secret writes resilient to transient Windows file locks (antivirus/indexing) by retrying the rename briefly. Windows-only behavior change.

Background / motivation

The security slice (Part 1) writes secrets via atomic temp-file + rename. On Windows, AV or the search indexer can hold a short-lived lock on the target during the rename, surfacing as EBUSY/EPERM/EACCES and crashing the write. A bounded retry absorbs that window.

What changed

• src/config.ts — new renameAtomicFile(source, destination, io):
  • Retries only on win32 for EBUSY/EPERM/EACCES.
  • Up to 2 retries with backoff 25ms, then 50ms; rethrows afterward.
  • Injectable AtomicRenameIO { platform, rename, sleep } so tests simulate transient failures deterministically.
• tests/config.test.ts — covers first-attempt success, transient-then-success, exhausted-retries rethrow, and non-Windows single-attempt.

Usage

Transparent. Non-Windows keeps a single rename with no retry.

Risk

• Blast radius: low, isolated to the atomic-write helper.
• Bounded: max 2 retries (~75ms total) before rethrowing the original error.

Testing

config -> pass (including injected transient-failure cases). Full suite green.