[B5] Bundle install-id scoping + Windows atomic flip

[radical]

Track B implementation. Depends on Q2 (#31) and Q6 (#36).

Two related changes:

1. Bundle scoping: change ~/.aspire/bundle/<ver>/ to ~/.aspire/bundle/<install-id>/<ver>/ so two installs at the same version don't collide on extraction or reparse-flip. Reparse-point target moves under <install-id>/.

2. Windows atomic flip: ReparsePoint.cs:72-78 uses RemoveIfExists+Move. Replace with MoveFileExW(MOVEFILE_REPLACE_EXISTING) or directory junction transactional swap. From reparse-flip-risk.md.

Plus: tighten TryCleanupStaleVersions to operate within a single install-id, fix the legacy managed/ migration hard-failure path.

Code touched

• src/Aspire.Cli/Bundles/BundleService.cs (TryFlipLinks, TryRestoreLinks, TryCleanupStaleVersions, EnsureExtractedAsync)
• src/Aspire.Cli/Bundles/ReparsePoint.cs:72-78

Scenarios advanced

S5.1–S5.5, S7.1, S7.2.

---

Part of: #29

[radical]

Design implications from ordering-scenarios.md (#29):

From O5, O6:

• Install-id stability across same-route --self: when S self-updates from 13.4.0 to 13.4.1, the binary path doesn't change, so install-id (route+location hash) is stable. The bundle dir nests by version under that install-id: bundle/<install-id>/13.4.0/... and bundle/<install-id>/13.4.1/.... No identity churn.
• Atomicity at the flip site is still required (O5.1, O6.3): a long-running aspire run cannot have its bundle yanked. Versioned dirs already give us that; the swap is "create new versioned dir, write new sentinel, leave old dir until cleanup pass". Old dir cleanup respects in-use detection (file handles on POSIX, exclusive-lock probe on Windows).
• Cross-route bundle isolation (O6.1, O6.5): S@13.4.0 and W@13.4.0 must land in distinct bundle dirs, even at the same version. Install-id (which encodes route + location) handles this.
• Manual deletion of ~/.aspire/bundle/ while CLI runs (O6.4) — accepted limitation; document. Re-extraction on next first-run.
• Same-version GC: when both routes carry 13.4.0, neither should GC the other's bundle. GC scope is per-install-id only.
• Reparse-point flip: continue using the post-Add symlink/junction support for bundle installs with versioned directories microsoft/aspire#16408 versioned approach. The shared bundle/ symlink (if any) should be replaced by route-scoped paths so two routes never race the same symlink target. (Confirm in B5 implementation that no shared bundle symlink remains.)
• First-run race after install (O6.1): if both routes' first run happens concurrently, each extracts to its own install-id dir — no contention.

Companion runbook scenarios: §5.1, §5.2, §5.3.
Runbook gist: https://gist.github.com/radical/86bce917075fd87e684be5c3aecb0c37