fix(desktop): keep the atomic-save retry off non-file targets

The retry after a failed rename exists for Windows, which may refuse to
replace an existing file. It removed the target unconditionally through
`remove_if_exists`, which deletes a directory recursively — so a path
occupied by a directory (`.openseek/worktrees.json/`, say) was erased
along with everything under it, and the write then reported success.

This was inherited from `write_settings_file`, but promoting it into a
shared helper spread it to the workspace and worktree registries.
Restrict the retry to a regular file at the target and re-raise the
original rename failure otherwise, so a wrong path is reported rather
than cleared.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: tonyfettes

desktop/internal/fsx/lock.mbt

@@ -97,8 +97,18 @@ pub async fn write_text_atomic(
   )
   @fs.rename(temp.to_string(), target) catch {
     error if @async.is_being_cancelled() => raise error
-    _ => {
-      remove_if_exists(path)
+    rename_failure => {
+      // The retry exists only for the Windows refusal above, which is a
+      // regular file standing in the way. Anything else at the target is a
+      // different failure and must surface as one: a directory there means
+      // the path is wrong, and removing it would recursively destroy whatever
+      // it holds rather than report that.
+      let replaceable = (@fs.kind(target) is Regular) catch {
+        error if @async.is_being_cancelled() => raise error
+        _ => false
+      }
+      guard replaceable else { raise rename_failure }
+      @fs.remove(target)
       @fs.rename(temp.to_string(), target)
     }
   }
@@ -166,6 +176,24 @@ async test "shared locks admit each other" {
   @fs.rmdir(root.to_string(), recursive=true)
 }
 
+///|
+/// The Windows retry must not turn "something else already occupies this
+/// path" into a recursive delete of whatever that something holds.
+async test "an atomic save refuses a target that is not a regular file" {
+  let root : @pathx.Path = @fs.tmpdir(prefix="openseek-fsx-kind-")
+  let occupied = root.join("registry.json")
+  ensure_dir(occupied)
+  let kept = occupied.join("keep.txt")
+  write_text_atomic(kept, "precious")
+  let mut refused = false
+  write_text_atomic(occupied, "clobber") catch {
+    _ => refused = true
+  }
+  assert_true(refused)
+  assert_eq(read_text(kept), "precious")
+  @fs.rmdir(root.to_string(), recursive=true)
+}
+
 ///|
 /// A released lock must leave nothing behind that keeps the next acquire out
 /// — the failure this catches is `release` closing the descriptor without