Apply the accepted pre-release package, service, type, directory, and role renames as one repository-wide change.
writeFileAtomic: exclusive-create random-suffix temp + rename carrying the caller-stated mode; settings-local persistSection now consumes it. The credentials-local store shares it next.