Parity/robustness follow-ups from the Rust port review #264

Deferred post-cutover follow-up from the Rust port review; see PR #260 and tracking ticket #261 (plan map #248).

These are robustness / UX-consistency items and one documented parity gap, deferred because changing them pre-merge would either diverge from the frozen Python reference or churn parity-pinned tests.

• Provision streaming (B9). provision_tools batches its notices and emits them at the end, where every other long-running path streams notices as they happen. Cheap fix: ~5 signatures change, 0 test changes expected.
• Dedup reporting (B5/B6).
  • B5 — a purge failure is reported twice through two paths; the binary currently carries a say_except_purge_failures helper purely to undo the duplication. Report it once at the source and delete the helper.
  • B6 — --reconcile re-derives success by scanning for the absence of a failure record (O(n²)) and ignores the repointed case. Have the plan/outcome carry success directly.
• Completion-cache shared temp name. completion_cache.rs:166 writes via a shared completions.tmp, and two overlapping --update-cache children are routine, so a losing writer can have the wrong file renamed over its output. The code already has a TODO at completion_cache.rs:158. Either use distinct (randomized) temp names or add a divergence-table row documenting the shared-name behavior.
• F5 — current_exe() refresh child. session.rs:85 spawns the detached completions-refresh child via current_exe(). After pixi global update swaps the binary mid-run, current_exe() resolves to /path/dl (deleted), the "dl" fallback never fires, the spawn fails with ProgramNotFound, and completions silently lose freshness. Python's sys.executable + -m survives this. Fall back to the bare program name (or a re-resolved path) when current_exe() points at a deleted file.
• P5 — stricter JSON reader than Python. The Rust reader rejects NaN / Infinity / 1e400 / lone-surrogate escapes, so a metadata.json containing any of them is moved to .corrupt and the cache is emptied, where Python keeps the records. Realistically this needs a hand-edit or a third-party writer, and the .corrupt file is preserved so nothing is unrecoverably lost — but either soften the reader to accept what Python accepts, or add a divergence-table row documenting the stricter behavior.