Make local ClickHouse installs atomic and concurrency-safe

[sdairs]

Summary

• Give every install a UUID-named staging directory that only its owning process cleans up.
• Serialize target-version and master-sidecar commits with cross-process file locks, then atomically rename complete binaries and sidecar files into place.
• Invalidate matching master metadata before the binary swap so interruption preserves a complete binary without a stale ETag.
• Add deterministic subprocess coverage for same-version and different-version races, interruption, and stale staging, asserting final binary contents and sidecar state.

Tests

• cargo test -p clickhousectl version_manager::install::tests -- --nocapture (10 passed)
• cargo test -p clickhousectl (all passed)
• cargo test -p clickhousectl --no-default-features (all passed)
• cargo build -p clickhousectl
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings

Stack

• Position: 3 of 3
• Base: issue-459-version-network-bounds-v2 (Bound and classify local version-manager network operations #496)

Closes #456

_{Stack created with GitHub Stacks CLI • Give Feedback}