[codex] harden atomic writes and checks

[explicit09]

Summary

• Add atomic file replacement helper for ref/object writes, including Windows replacement via MoveFileExW.
• Verify object hashes on read and repair corrupt object paths on write.
• Route branch/ref updates through atomic writes and ignore stale temp ref files in branch listings.
• Expand release CI to include Rust fmt, clippy, Rust tests, and Python tests.

Root Cause

The previous atomic-write fallback could delete an existing destination before renaming the temp file on Windows-like rename semantics. A crash or second rename failure could leave branch refs or objects missing. Ref temp files were also created in refs/heads, so stale crash leftovers could appear as branches.

Validation

• cargo test --workspace --exclude vedit-py
• cargo clippy --workspace --exclude vedit-py -- -D warnings
• cargo fmt --check
• cargo check -p vedit-core --target x86_64-pc-windows-msvc
• git diff --check