fix(worker): clean unpublished downloads after restart

[Excelius-Wang]

What changed

If the worker exits while copying a PDF, restart recovery changes its pending transfer journal to failed but leaves the unpublished PDF on disk. A metadata write interrupted before rename can also leave a .json.tmp file.

Reuse the existing recovery path to remove both files before persisting the failure. Only ENOENT means metadata is absent; other inspection or cleanup errors propagate and leave the journal pending for retry. Published downloads retain their PDF and metadata, and ordinary failure-list reads leave active transfers alone. Previously failed historical records are outside this change.

Add real-filesystem regressions for cleanup, failure preservation, published downloads, missing files, repeated recovery, metadata inspection errors, and partial cleanup retry. Extend the existing worker startup/API test to verify orphan removal.

Verification

• Node 24.21.0 / pnpm 11.19.0; frozen-lockfile installation, no dependency changes.
• pnpm lint, pnpm typecheck, pnpm --dir apps/worker typecheck, and pnpm build:server passed.
• pnpm test: 282/282 passed, no skips.
• Web/iOS/Android bundle exports passed with --max-workers 2.
• On current main, the recovery regressions fail before the production patch and pass afterward (6/6).
• Reproduced the orphan using production capture/startup code, a controlled download stream, actual PDF bytes on disk, and SIGKILL of the capture child; the same probe passes after the fix. Successful PDF publication and published-journal reconciliation also pass.

Integration limits

• pnpm test:browser fails locally before download recovery: httpbin URL validation returns BLOCKED_URL where the test expects NAVIGATION_FAILED. The same failure was reproduced on the unmodified baseline. Chromium installation succeeded.
• Supplemental real-Chromium checks passed 2/2 in a separate validation worktree combining this recovery patch with the controlled fixtures from test(browser): use controlled fixtures for lifecycle and Docker suites #127. Those fixture changes are not included here.
• Docker was unavailable locally. Platform checks are bundle exports; native devices and Windows filesystem behavior were not tested.

[jerelvelarde]

Reviewed head 4237f3b5780d.

High-value download recovery fix. The patch removes unpublished bytes before marking the journal failed, retains pending journals when cleanup cannot finish, and preserves published PDFs and ordinary reads of active transfers. The added real-filesystem cases cover partial cleanup retry, metadata errors, missing files and repeated recovery; no blocking security or template-fit issue found in the diff.

Prioritize the controlled fixtures in #127, then recheck the browser suite with this recovery patch. The current workflow is action_required; the baseline browser failure in the PR body remains an author-reported limitation until that CI/integration check runs. This review was static; I did not rerun tests.

[jerelvelarde]

Useful bounded recovery fix: removes unpublished PDF/temp metadata before marking interrupted downloads failed, preserves published files, and propagates inspection errors without losing retry state. Template documents actual checks/limits. All 24 browser/API tests pass locally, including real filesystem error/retry regressions. No actionable correctness or security findings.