feat(config): forge each casting document against a reconciled lock

[Nageshbansal]

Cast and melt never read casting.yaml; they act on casting.yaml.lock. That makes the lock's behaviour deployment behaviour, and today it has two failure modes in a multi-document file:

• Forge is all-or-nothing across documents. One document failing (say a typo in the CollectionAgent) means nothing forges and no lock is written, so a valid Installation in the same file cannot be cast either.
• The lock is written in place. An interrupt mid-write leaves a truncated lock, and the next cast or melt acts on it.

This PR makes forge per-document and the lock durable.

casting.yaml (N documents) ── forge each on its own
        └─► casting.yaml.lock: replace the document's own entry, keep the others,
            prune entries the file no longer declares

Features

• Forges each casting document on its own and pours it as it lands. A failing document no longer blocks the rest; it keeps its last forged lock entry until it forges again.
• Prunes lock entries for documents the file no longer declares before the run, so a removed casting can no longer be cast or melted from a stale entry. A lock pruned to nothing is removed; a zero-byte lock reads as empty.

Fixes

• Writes the lock through a temporary file and rename, so an interrupted write can never truncate it.

Refactors

• Plan/Forge/Cast take one casting document; the commands loop the declared documents.
• Lock entries are keyed by the loader's collision identity (kind, qualified by its discriminator).

Tests

• Pins lock round-trips, partial runs, out-of-order records, pruning, and the entryless-lock removal.

Related: https://github.com/SigNoz/platform-pod/issues/2966