fn rename_with_retry(from: &Path, to: &Path) -> Result<()>
fs::rename, retried briefly when Windows refuses to replace a file another process holds open; never falls back to a non-atomic write.
fs::rename