Integrate verified installation flow (T-302)

core/storage/installed_app.go

@@ -64,6 +64,15 @@ func NewInstalledAppStore(appsRoot string) *InstalledAppStore {
 	return &InstalledAppStore{appsRoot: appsRoot}
 }
 
+// EnsureAppRoot creates and validates the real apps/<id> directory used by an
+// installer transaction. It does not write an installed-app record.
+func (store *InstalledAppStore) EnsureAppRoot(appID string) (string, error) {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	return store.ensureAppRoot(appID)
+}
+
 // Write validates and atomically replaces one installed-app.json.
 func (store *InstalledAppStore) Write(record InstalledApp) error {
 	store.mu.Lock()
@@ -413,7 +422,11 @@ func replaceInstalledAppFile(directory, target, backup string, document []byte)
 	}
 	if movedTarget || hadBackup {
 		if err := os.Remove(backup); err != nil && !os.IsNotExist(err) {
-			return fmt.Errorf("remove installed app backup: %w", err)
+			// The new target is already atomically active. Reporting a cleanup
+			// failure here would make callers roll back a healthy current
+			// directory while this record already names the new version. Keep the
+			// regular recovery backup for a later successful replacement instead.
+			return nil
 		}
 	}
 	return nil