Story 5.2 — Implement external-files.yaml install via atomic write during freeze phase

**Epic:** #502 — Network Upgrade Workflow (Execute Phase)

Stage verified files to their declared `destination` during the `frozen` install phase using atomic write.

**Acceptance criteria:**
- Read each file from the upgrade staging dir `…/data/upgrade/current/` (where both UC prepare-downloads and daemon freeze-downloads live).
- Atomic install: copy from staging to `.tmp` **on the destination's own filesystem**, fsync, then rename to the final path. A bare cross-filesystem `os.Rename` fails with `EXDEV`, so the temp MUST sit beside the destination, not in the staging dir.
- Resolve `destination` only via the recognised directory-marker prefixes `HAPIAPP_DIR` / `SOLO_PROVISIONER_DIR`; reject arbitrary/escaping paths (use `sanity.ValidatePathWithinBase` against the resolved marker root).
- Set ownership per marker: files under `HAPIAPP_DIR` → `hedera:hedera`; files under `SOLO_PROVISIONER_DIR` → `weaver`/root. Choose a sane mode (e.g. 0640/0644).
- Only install entries with `phase.install: frozen` (currently the only install value — defensive guard).
- Emit `FilesPlaced` after all files are successfully staged.

---

## Archives support (added per HIP external-files spec update)

The `archives:` top-level key (parser: #1084) introduces archive-level install logic:

### Extraction and verification
- Extract to a staging directory **on the same filesystem** as the final destination — never directly into the destination
- Enumerate members and enforce the **authoritative-contents invariant** before any per-member checksum work:
- A regular-file member present in the archive but absent from `contents` → abort
- A `contents[].path` entry absent from the archive → abort
- Non-regular members (symlink, hardlink, device node, FIFO, socket) → reject outright (`ArchiveUnsafeMember`), never extract (tar-slip / zip-slip mitigation)
- Directory entries are ignored for the equality check (structural only)
- Verify every member's `algorithm`+`checksum` in staging

### Atomic unit install
- Move members into place **only after every member has been verified**
- A partially installed archive leaves the host in exactly the partial state the required-entry rationale warns against
- The destination is a **directory**, not a file — different from `files[]`
- Per-member `destination` override (optional) must also use marker-prefix policy
- Set ownership per marker (same rules as `files[]`)

### Error classifications
- `ArchiveContentsMismatch` — archive membership ≠ `contents` (either direction)
- `ArchiveMemberHashMismatch` — extracted member checksum mismatch
- `ArchiveUnsafeMember` — non-regular member or path-escaping member

Depends on: #1084 (parser), #537 (archive download + archive-level checksum)