fix(kit): retry promote() retire-rename on Windows ACCESS_DENIED

[aheritier]

🤖 Automated implementer agent — this comment was posted by the implementer bot from Docker Agentic Platform, not by a human developer

Fixes TestBuild_ConcurrentRunsForSameAgentAreSafe failing on Windows in CI run 31013010316.

Root cause: promote() in pkg/sandbox/kit/kit.go renames finalDir aside (to a .old-… sibling) before atomically installing the new kit. On Windows, os.Rename fails with ERROR_ACCESS_DENIED when another goroutine holds an open handle to that directory. Concurrent Build() calls for the same agent hit this exactly.

Fix: Add a build-tagged helper isRetryableRenameErr():

• rename_windows.go (//go:build windows): returns errors.Is(err, syscall.ERROR_ACCESS_DENIED)
• rename_other.go (//go:build !windows): always returns false

In the retire-rename error path, treat a retryable error as a loop continuation (set lastErr, call runtime.Gosched() to yield to the competing goroutine, then continue) instead of returning hard. On POSIX, EACCES on a rename is a genuine hard error and the path is unchanged.

Testing: TestBuild_ConcurrentRunsForSameAgentAreSafe passes on POSIX; the Windows path compiles cleanly (GOOS=windows go build/vet).

Reviewer note: The reviewer noted that isRetryableRenameErr has no Windows unit test (since CI doesn't run Windows-tagged tests on Linux). The function is a single errors.Is call with no branch; correctness is covered by the concurrent integration test in Windows CI.