fix(persistence): FlushAndAck is a durability barrier that reports lost writes

The persistence actor acked FlushAndAck unconditionally after writing its
pending merged notification: nothing was fsynced and every storage failure
was only warn-logged, so persist_ack, the reconnect flush and history
repair treated lost writes as persisted.

The barrier now writes the pending notification, reports the first storage
failure latched since the last barrier (every actor arm latches), and
fsyncs the whole session directory tree (files, directories, deletions).
Session directories are created durably (init and fork copy), and the
shared summary writer syncs its staged bytes before publishing and the
parent afterwards, so a concurrent /rename cannot publish unsynced bytes
over a synced summary.json. FlushComplete and the persist_ack, history
repair and end-of-turn callers propagate the io::Result; CopyFile fails on
a sync error but keeps the latch for the barrier.

Ported from upstream 1.0.1x (grok-build persistence.rs pending_write_error
+ durable storage helpers), reshaped without the dirty-file set.

Claude-Session: https://claude.ai/code/session_01RUqV8HVGXcAETyYbZ2tPQ4

crates/codegen/kigi-shell/src/session/storage/summary_write.rs

@@ -228,12 +228,13 @@ fn read_summary(path: &Path) -> io::Result<Summary> {
 fn write_summary_atomic(summary_path: &Path, summary: &Summary) -> io::Result<()> {
     let bytes = serde_json::to_vec_pretty(summary)
         .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
-    let tmp = summary_path.with_extension("json.tmp");
-    std::fs::write(&tmp, &bytes)?;
-    // Windows-safe replace: this is the write that persists a session's
-    // CURRENT MODEL — a bare rename made a switched model silently revert
-    // on resume whenever AV/indexer held summary.json open on Windows.
-    crate::util::fs::replace_file(&tmp, summary_path)
+    // Durable and Windows-safe: this write persists a session's CURRENT MODEL,
+    // and other writers (`/rename`) race the persistence barrier on this path.
+    super::write_bytes_atomic(
+        &summary_path.with_extension("json.tmp"),
+        summary_path,
+        &bytes,
+    )
 }
 
 #[cfg(test)]