Install CurseForge dependencies atomically and fail closed on setup errors

[Exohayvan]

Summary

The live tester deletes existing dependency JARs before replacement downloads are safely installed, then catches installation failures and continues toward launcher testing.

Evidence

• common/scripts/curseforge_testing.py:2271-2284 treats dependency resolution failure as a warning.
• Lines 2294-2299 remove existing dependency files before downloading directly to the final path.
• Lines 2355-2363 catch installation exceptions and return normally.
• The plan can then be considered ready for launcher testing despite missing or truncated dependencies.

Impact

A working CurseForge profile can be damaged, and setup failures are misreported as Minecraft/mod runtime failures instead of stopping at the correct stage.

Reproduction / verification

• Inject resolution, disk-full, interrupted-download, checksum, and rename failures.
• Verify the prior dependency survives byte-for-byte and the affected instance is marked setup-failed.

Proposed direction

Download to a temporary file, verify advertised digest and size, flush, atomically replace the old JAR, and propagate per-instance installation failures so launcher testing cannot continue.

Acceptance criteria

• Failed installation never removes the previous valid dependency.
• Partial files are never exposed under the final JAR name.
• Resolution/install failures fail the affected plan closed.
• Tests cover every destructive boundary.

Audit provenance

Candidate #20 from the read-only repository audit performed on 2026-07-20. This is separate from existing issues #3, #4, #25, and #27 unless explicitly linked later.