Keep last-good bundle on activation failure

BundlePlugin.Bundle.activateBundle rethrows on any error during loading or store write, so a bad bundle (corrupt tar, parse failure, root violation once #63 lands) can leave the plugin in ERROR state with no policy at all. OPA Go keeps serving the previously activated bundle when activation of a new one fails.

• On activation failure, log the error and keep the previously activated bundle live.
• Mark the per-bundle status as failed (feeds the per-bundle status events issue) but don't tear down the existing store contents.
• Initial activation is the special case: the first failure has no last-good to fall back on, so it still completes the initial-activation future exceptionally.
• Tests: corrupt bundle on second activation keeps prior data; corrupt bundle on first activation still fails fast.

Start at BundlePlugin.Bundle.activateBundle and trace loading, store writes, activation state, and the initial-activation future. Add tests for a corrupt bundle on second activation retaining prior data and for a corrupt first activation failing fast. Done means failures mark the bundle as failed while the last-good bundle and its store contents remain live.