feat(peer): journal download file ownership

Track the exact regular files owned by each completed and in-flight peer
download instead of sweeping every non-reserved path after cancellation. Bind
the record to the canonical games directory, publish pending ownership before
payload mutation, and use the final version.ini rename as the recovery commit
point.

Make replacement, cancellation, and startup recovery preserve unknown files
and install state while removing stale or partial downloader-owned bytes. Add a
new-format baseline so legacy discarded sentinels cannot make partially
modified payloads ready, sync payload and journal state in transaction order,
and serialize startup recovery against operation admission.

Document ambiguous legacy target adoption, portable alias transitions, and the
other ownership tradeoffs in the refactor decision log.

Test Plan:
- `just clippy` -- passed
- `just test` -- passed (182 peer-core tests plus the full workspace)
- `just fmt` -- Rust, TOML, and Prettier formatting completed; the command then
  stopped on 40 pre-existing rumdl findings in unrelated Markdown content
- `git diff --cached --check` -- passed

crates/lanspread-peer/src/state_paths.rs

@@ -6,6 +6,8 @@ const LOCAL_LIBRARY_INDEX_FILE: &str = "index.json";
 const GAMES_DIR: &str = "games";
 const SETUP_DONE_FILE: &str = "setup_done";
 const LAUNCH_SETTINGS_APPLIED_FILE: &str = "launch_settings_applied";
+const DOWNLOAD_OWNERSHIP_FILE: &str = "download_ownership.json";
+const DOWNLOAD_OWNERSHIP_TMP_FILE: &str = "download_ownership.json.tmp";
 
 pub(crate) fn resolve_state_dir(explicit: Option<&Path>) -> PathBuf {
     if let Some(dir) = explicit {
@@ -46,3 +48,11 @@ pub fn setup_done_path(state_dir: &Path, game_id: &str) -> PathBuf {
 pub fn launch_settings_applied_path(state_dir: &Path, game_id: &str) -> PathBuf {
     game_state_dir(state_dir, game_id).join(LAUNCH_SETTINGS_APPLIED_FILE)
 }
+
+pub(crate) fn download_ownership_path(state_dir: &Path, game_id: &str) -> PathBuf {
+    game_state_dir(state_dir, game_id).join(DOWNLOAD_OWNERSHIP_FILE)
+}
+
+pub(crate) fn download_ownership_tmp_path(state_dir: &Path, game_id: &str) -> PathBuf {
+    game_state_dir(state_dir, game_id).join(DOWNLOAD_OWNERSHIP_TMP_FILE)
+}