Write the draft envelope before the shards so a torn save leaves stale content, not absent content

saveDraft writes every changed shard, then the envelope naming them. A save torn between those two steps leaves a book that this save analyzed for the first time named by no manifest — the old envelope predates it, the new one never landed — so its work is unreachable on reopen.

Writing the envelope with old ∪ new books before the shards would close that: every book stays named throughout, so a torn save yields stale content rather than absent content.

This is safe because a manifest naming a not-yet-written shard is already handled — readAnalysisShard returns readable: false for ENOENT, so the book is held rather than wiped:

https://github.com/sillsdev/interlinearizer-extension/blob/main/src/services/projectStorage.ts#L234-L241

Cost is one extra envelope write, and only when the book set grows.

Field-vs-shard skew is inherent regardless — papi.storage.writeUserData is a plain fs.promises.writeFile, so no single write here is atomic. This only closes the silent-absence case.

Note the delete step's ordering rationale ("deleting only once the envelope has stopped naming the book keeps a failure here from stranding the manifest on a missing shard") would need reworking alongside this, since the envelope would no longer be written exactly once per save.

Raised by @imnasnainaec (drafted by Devin) reviewing #316, and deferred from it as out of scope.

Start in src/services/projectStorage.ts, around the readAnalysisShard logic at lines 234-241, then trace saveDraft and its shard, envelope, and delete ordering. Confirm the envelope-write behavior for a growing book set and revisit the deletion rationale. Done means a torn save leaves stale content rather than an unnamed book, while missing shards remain held rather than wiped.