Clean up failed checkpoint writes

[im-kvijay]

Proposing a focused cleanup fix for #3646. Checkpoint staging currently uses a temporary index but writes packs into the shared object store, where failures can leave temporary files behind.

Each capture would own its index and new objects, then publish completed objects before its hidden ref. Failed staging removes only its own storage; Git's temporary-directory prefix lets normal pruning reclaim stale crash leftovers. Snapshot contents, the user's index, and the 30-second deadline stay unchanged.

The implementation has 68 passing focused tests, including three cleanup regressions that fail upstream, plus typechecks and targeted lint/format checks. It touches five files with 114 effective non-test changed lines (size:L). In a local 2,000-file fixture, capture medians changed from 30.6 to 32.0 ms for 10 modified files and 90.0 to 118.5 ms for all files modified.

This addresses staging debris, not long-capture scheduling. Pack/index publication can still fail partially, and private storage adds an alternates level. Related #4338, #8301, and #4517 remain unmerged. Implementation for review: #9809.

Created with GPT-6 in Codex.

[im-kvijay]

Following the new reproduction in #3646, proposing a separate performance fix alongside the cleanup in #9809: seed the private checkpoint index from the workspace index, reset it to HEAD while retaining matching stat metadata, then keep the existing scoped git add -A.

This follows the index-reuse idea in #8538 but falls back to a fresh index for special flags or failed/truncated inspection. It does not need the changed-path parser from #8301. Snapshot selection, the workspace index, and the 30-second timeout remain unchanged.

The independent patch changes two files, with 32 added and 6 removed production lines. On current main (061543e9e), 38 focused tests and scoped checks pass. Five paired 40,000-file captures improved from a median 242.5 ms to 74.1 ms with identical trees. Large genuinely new files still require hashing, so this does not resolve every timeout reported in #3646.

Implemented and verified with GPT-6 Astra through the Codex harness.