fix(ms-ai-architect): RX-OPS2 skrive-sikkerhet i driverne — scoped restore + atomiske skriv [skip-docs]

- backup.mjs restore(relPaths): SCOPED per-fil-rollback erstatter hel-tre rmSync(srcDir)+cpSync.
  Ruller kun tilbake kjøringens egne skriv; parallelle økters skriv til søsken-filer overlever;
  intet destruktivt rm→cp-vindu. Nyskapte filer slettes; prior bytes gjenopprettes atomisk.
- migrate-corpus.mjs: returnert restore() er nå en null-arg closure bundet til kjøringens skrive-
  liste (public API uendret) → scoped. detectStaleRollback aborterer ved forrige krasj-sentinel;
  cleanupOldBackups pruner backups forbi retention etter vellykket batch.
- 5 drivere (backfill-status/-category, dedup-plain-header, relabel-dato/-dialect):
  writeFileSync → atomicWriteSync (crash-safe tmp+rename) + recovery-kontrakt i header.
- backfill-category.mjs: refaktorert importerbar (isMain-guard + run()/planCategoryBackfill/
  categoryForFile/FOLDER_CATEGORY-eksporter, parameterisert root) → testbar uten scan-side-effekt.
- Tester (+16): 6 scoped-restore (parallel-preservering, ny-fil-sletting, throws-guard) erstatter
  2 hel-tre; test-backfill-category (frosset taxonomi + hermetisk plan); test-driver-atomic-writes
  (5 drivere); migrate stale-abort + cleanup-wiring. Suite 859→875 exit 0. validate-plugin 250/0.

scripts/kb-update/dedup-plain-header.mjs

@@ -21,11 +21,15 @@
 //
 // Closes the last 4 of the corpus's Missing-Status and all 4 Missing-English-Last-updated.
 //
+// Recovery contract: writes are crash-safe (atomicWriteSync tmp+rename — a reader sees the old
+// file or the new one, never a partial); an interrupted run is recovered by re-running (idempotent).
+//
 // Usage:  node scripts/kb-update/dedup-plain-header.mjs [--dry]
-import { readFileSync, writeFileSync, existsSync, realpathSync } from 'node:fs';
+import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { boldifyPlainField, dropRedundantPlainField } from './lib/transform.mjs';
+import { atomicWriteSync } from './lib/atomic-write.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = join(__dirname, '..', '..');
@@ -125,7 +129,7 @@ function run({ dry }) {
     for (const p of planned) console.log(`  ~ ${p.rel}`);
     return;
   }
-  for (const p of planned) writeFileSync(join(PLUGIN_ROOT, p.rel), p.out);
+  for (const p of planned) atomicWriteSync(join(PLUGIN_ROOT, p.rel), p.out);
   console.log(`\nWrote ${planned.length} files.`);
 }