…uards

- Add IDocsFileStore.isDirectory and use it in countFiles. Inferring
  file-ness from an empty readdir counted an empty directory as a file,
  which real extractors can produce, and relied on behaviour a node-backed
  store does not have (it throws ENOTDIR on a file).
- Make _prune best-effort. A readdir or unlink failure threw out of
  ensure() and discarded an install that was already on disk.
- Track a generation counter so invalidate() called mid-fetch is not
  overwritten by the completing attempt re-arming the session gate.
- Log an unexpected HEAD status on the convergence check; 404 stays quiet.
- Drop all-slashes segments in joinDocsPath, which left a trailing slash.
- Encode the fake zip as JSON so entry contents cannot mis-split.
- Assert state content after a 304, add empty-directory and mid-flight
  invalidate coverage, and cover joinDocsPath.

The cap exists to bound a write the digest cannot vet until the bytes have
landed, not to express an expected bundle size. Since it ships baked into a
client while the bundle publishes separately, a client that trips it falls
back to web docs with no way to fix it after the fact. The publish pipeline
now enforces the real size budget.

…tate

Each rejection case now asserts the reason it was refused, so a case can no
longer pass on a different failure than the one it names. Adds coverage for a
state file pointing at a deleted version directory and for an unparseable
state file, and replaces a test that asserted on the shape of the logger fake
with one that asserts the level each outcome kind logs at.

"Ports" collides with base/common/ports.ts and base/node/ports.ts, which are
about TCP ports, and the module does HTTP - so the name invites the wrong
reading. "Sidecar" now reads as the container pattern more than the companion
file it means here; "checksum file" says the same thing plainly and pairs with
the digest it holds.

At install time the previous state.json already names the one directory
being superseded, so delete it by name instead of sweeping the cache
root. This removes the mtime guard, the DOCS_PRUNE_IDLE_MS constant, and
the mtime port method, and closes the cross-window hazard by removing
the scan that caused it. Crash debris is no longer collected; it is
bounded by crash count and judged not worth the machinery (design doc
revision 11).

The only 'artefact' left in src/vs; 37 files already use 'artifact'.

… survives