[br] BR retry can leave a missing metadata reference that blocks later PiTR

## Bug Report

### 1. Minimal reproduce step (Required)

**Environment**

TiDB master 05b396fb6636f73b3bc06b09107cf43f2c725c35

**Steps**

Enable log backup; start snapshot restore; terminate BR after AppendMigration persists IngestedSstPaths but before the initial extbackupmeta WriteFile; retry restore successfully; run log restore over the same storage. Focused test: TestPiTRCollectorPublishedMigrationMustNotReferenceMissingMeta.

### 2. What did you expect to see? (Required)

Every migration reference must name a durable readable metadata object after retry; later log restore must consume the chain.

### 3. What did you see instead? (Required)

The old missing path remains beside the retry path, and stream.LoadIngestedSSTs fails with failed to read backup / no such file or directory.

### 4. What is your TiDB version? (Required)

TiDB master 05b396fb6636f73b3bc06b09107cf43f2c725c35

Likely root cause and fix direction

**Likely root cause**

pitrCollector.prepareMig appends the durable migration reference before creating extbackupmeta; retry generates a fresh TSO-derived path and cannot repair the old reference.

**Fix direction**

Persist initial extbackupmeta before AppendMigration, or atomically retire/repair failed-attempt references.

Start by running TestPiTRCollectorPublishedMigrationMustNotReferenceMissingMeta and tracing pitrCollector.prepareMig through AppendMigration and the initial extbackupmeta WriteFile. Check how stream.LoadIngestedSSTs reads migration references during log restore. Done means a terminated attempt cannot leave an unreadable reference, retries produce a durable readable metadata chain, and the focused test passes.

Written by the indexing model from the issue text.