Hub: partial package installs never self-heal for foreign .c/.js files (raw ENOENT from eff_src)

Summary

book_load's store-refetch gate (bend.ts:997) only fires when the entry .bend file is missing; every file is written non-atomically with no rollback. For .bend files this mostly self-heals, because each later import of a missing store file re-triggers the gate. Foreign .c/.js files, however, are resolved by eff_src (comp.ts:3112 realpathSync) outside book_load, so a package whose foreign file is missing (interrupted first install, hub 404 mid-list, Ctrl-C) fails forever with a raw ENOENT from realpathSync instead of refetching, until the user deletes the store directory by hand.

Trigger

1. bend app.bend where app.bend imports 0x<hash>/x.bend and x.bend has a foreign import "./eff.c"; kill the process (or make the hub 404) after the .bend files are written but before eff.c.
2. Re-run: every .bend refetches fine, then Error: ENOENT ... eff.c (raw realpathSync failure), and no retry ever happens.

Suggested fix

Fetch the manifest into a temp dir and rename atomically, or treat a missing foreign file under BEND_LIB/0x<pkg>/ as a refetch trigger too (and delete the package dir on any mid-install failure).

Version / system

• bend 2.0.5 (main @ e6676b0); gate logic validated end-to-end against a local mock hub (per-file refetch works for .bend; the foreign path was confirmed by reading eff_src).