fix(launcher): harden installer transactions

docs/architecture/acdream-architecture.md

@@ -293,7 +293,11 @@ src/
     Installation/            -> portable four-DAT validation, Windows retail
                                 path discovery, versioned JSONL bake-process
                                 orchestration, and atomic SHA/size/tool-version
-                                install-record verification and recovery
+                                install-record verification and recovery; one
+                                OS-handle lease serializes recovery/install per
+                                DataDirectory, and only exact adjacent
+                                `.<pak>.acdream-bake.<guid:N>.tmp` files are
+                                transaction-owned crash residue
     -> references Platform only; no Avalonia or game-host dependency
 
   AcDream.Launcher/          Avalonia 12 Windows/Linux desktop shell
@@ -301,6 +305,8 @@ src/
                                 including the first-run DAT/bake wizard
     -> references Launcher.Core only (Platform transitively); it never owns
        a second profile, process, status, or credential state graph
+    -> every per-RID publish composes the separately published self-contained
+       `acdream-bake` executable beside the launcher without a project edge
     -> Linux launcher/probe/headless flows remain portable; graphical-client
        actions are explicitly disabled until Modern Runtime Slice L resumes