fix: publish complete compiled worker generations atomically

[seanperkins]

Concurrent host-service startup can expose partially compiled JavaScript, and the old fingerprint misses dependency/compiler changes. This follow-up builds each version in a private staging directory, atomically publishes a complete immutable generation, and runs each service from its selected generation.

It also fingerprints lockfiles, the installed compiler, Node, TypeScript/declaration inputs and MJS sidecars. Runtime MJS helpers are copied into the generation so later imports remain consistent. Failed builds preserve prior output and refuse to start stale code.

This draft is stacked on #244 (syd-268-precompile-host-scripts); its diff contains only the follow-up fix. No merge or deployment performed.

Closes #272.

Validation:

• 2,089 tests across 169 files passed locally, including concurrent startup, failed compilation, dependency/compiler changes, source changes during compilation, lazy imports, and MJS sidecars.
• Full lint, format, app/UI typechecks, UI build and server build passed.
• GitHub CI passed on the published head.
• Real compiled-entry startup smoke checks reached the expected missing-configuration/credential guards without contacting providers.
• Local tests used a 20-second test timeout and six workers for subprocess-heavy tests; normal GitHub CI remains enabled.

Operational notes: simultaneous cold starts can duplicate compilation safely. Old generations remain available for running services; stop all services before clearing dist/server. The root metadata file describes the last selected build, not all running processes.