fix(xim): make download cache commits transactional

[Sunrisepeak]

Summary

• make file-cache admission explicit and sidecar v2 identity/size aware
• download into unique staging files, verify before recoverable commit, and serialize competing processes
• classify extraction failures so only invalid input archives evict cache
• consume tinyhttps 0.2.9 transfer metadata before cache commit
• make libxpkg 0.0.44 the only platform parser, compatibility layer, and resource normalizer
• preserve legacy XLINGS_RES, mirrors, refs, per-arch resources, and platform-conditional recipes
• release as xlings 0.4.63

Cross-repository dependencies

• fix(http): reject incomplete chunked transfers mcpplibs/tinyhttps#9 -> 0.2.9 (released)
• feat(xpkg): centralize resource source normalization libxpkg#26 and [xlings]: 正式发布v0.1.0版本 - 功能checklist #27 -> 0.0.44 (released)
• chore(index): add tinyhttps 0.2.9 mcpplibs/mcpp-index#68 and tools: add profile file, and adapt bash/zsh/fish... #69 (merged; index artifacts published)
• fix(mcpp): verify XLINGS_RES artifacts before indexing xim-pkgindex#352 (compatibility-tested migration, held until this release passes)

Validation

• clean GLOBAL registry resolution of tinyhttps 0.2.9 and libxpkg 0.0.44
• mcpp build && mcpp test: 10/10 test binaries
• test_main: 214 tests, 197 passed and 17 fixture-dependent skips, no failures
• real subprocess file-lock contention passes
• transfer size rejection and committed GET metadata sidecar tests pass
• source/ref/template/mirror/legacy/per-arch resource compatibility tests pass
• libxpkg loader/compat tests and upstream CI pass
• tinyhttps protocol tests and upstream CI pass

Supersedes #358, whose stacked base caused already-merged #357 build files to remain in the displayed diff.