Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(codegen): windows rename retry + POSIX-mode-safe tests + lint

CI on #4262 failed on windows + fmt-and-lint, exposing real gaps in the
atomic-write change (all four are genuine, not flaky):

1. test (windows-latest, *): os.Rename over an existing file can fail
   TRANSIENTLY on Windows with "Access is denied" (MoveFileEx contends
   with a virus scanner / search indexer briefly holding an open handle
   on the destination). This broke TWO PRE-EXISTING tests
   (TestTemplateOverride, TestRenderFS) that windows CI was passing
   before this PR. Fixed with a short, bounded retry-on-EPERM loop
   around the rename (renameWithRetry) — the same workaround
   natefinch/atomic and tailscale/atomicfile ship for this exact
   Windows quirk; a no-op on non-windows (the common case still does
   exactly one os.Rename).

2. My own new tests (TestWriteIsAtomicPreservesPermissionsAndLeavesNoTemp,
   TestWriteIsAtomicAndUnchangedShortCircuit) asserted EXACT POSIX mode
   bits (0o644/0o600), which are meaningless on Windows — it has no
   real owner/group/other permissions (os.FileMode there is a coarse
   read-only-attribute emulation). google/renameio's own writefile.go
   is `//go:build !windows` for the same reason. Gated the POSIX-mode
   assertions on runtime.GOOS != "windows"; the platform-agnostic
   leftover-temp-file check still runs everywhere.

3. fmt-and-lint (1.25): three real golangci-lint findings, all mine:
   - api/generate.go: golang.org/x/tools/imports was in the stdlib
     import group instead of its own third-party group (gci).
   - codegen/templates/templates_test.go: writeContent's two string
     params should be combined (gocritic paramTypeCombine).
   - api/generate_test.go: two lines over the repo's 100-char golines
     limit.
   Verified clean against gofumpt, golines --max-len=100, and gci with
   the repo's exact section config (standard/default/prefix).

Verified: go build ./... clean; go test ./codegen/templates/... ./api/...
gre... (continued)