Make the Orbit skills:refresh transactional

Follow-up from the #181 review.

The Orbit "Refresh skills" button (`skills:refresh` in `app/src/main/ipc-handlers.ts`) deletes the cached catalogs and then restarts the agent, returning success immediately. The re-walk that rebuilds them happens lazily on the restarted agent's next turn. So right after a refresh the router renders from the builtin/empty fallback, and offline the custom-repo catalogs stay gone until the next successful walk (recovers on reconnect -- degraded, not permanent).

Make it verify-then-swap: walk + write the new catalogs, retain the old ones on failure, and restart/report success only once the refresh produced something. This is cross-process (the walk lives in the brain), so it likely means the button drives a foreground refresh rather than `rm`-ing from main.

Note: the foreground `/skills refresh` path is already safe now that discovery is all-or-nothing and keeps last-known-good (#181) -- this is specifically the Orbit button's clear-first approach.

Start in app/src/main/ipc-handlers.ts and compare the Orbit button with the foreground `/skills refresh` path described in #181. Trace how the button crosses into the brain, then verify that new catalogs are written before old ones are replaced, failures retain the old catalogs, and restart/reporting occurs only after a successful refresh.

Written by the indexing model from the issue text.