Fix quarantine non-atomic operations with two-phase commit

Implements atomic quarantine/restore operations using two-phase commit
pattern to prevent orphaned files when manifest updates fail.

Changes to models.py:
- Add status field to QuarantineEntry ("pending" | "committed")
- Default to "committed" for backward compatibility

Changes to quarantine.py:
- Rewrite quarantine_file() with three phases:
  1. Write pending manifest entry BEFORE moving file
  2. Move file to quarantine
  3. Mark manifest entry as committed
- Rewrite restore_from_quarantine() with same pattern
- Add _recover_pending_entries() for auto-recovery on manifest load
- Update _load_manifest() and _save_manifest() to handle status field

Changes to executor.py:
- Add special handling for quarantine rollback using QuarantineManager
- Fix bug where executor didn't preserve quarantine destination_path
- Return QuarantineManager result directly (includes actual quarantine path)

Testing:
- Fixed pre-existing test_rollback_quarantine_operation
- All 439 tests now pass (was 438 with 1 failure)

Atomicity guarantees:
- If manifest write fails → operation fails, no file moved
- If file move fails → rollback removes pending manifest entry
- If commit fails → auto-recovery fixes on next load
- No orphaned files possible

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/vlm/executor.py

@@ -169,15 +169,11 @@ class ExecutionEngine:
                     error_message=None,
                     executed_at=executed_at
                 )
-            result = self._quarantine_manager.quarantine_file(
+            # Quarantine the file and return the result directly
+            # (includes the actual quarantine destination_path for rollback)
+            return self._quarantine_manager.quarantine_file(
                 operation.source_path, operation.reason
             )
-            return OperationResult(
-                operation=operation,
-                success=result.success,
-                error_message=result.error_message,
-                executed_at=result.executed_at
-            )
 
         # Handle conflicted operations
         if operation.has_conflict:
@@ -536,6 +532,43 @@ class ExecutionEngine:
                 executed_at=executed_at
             )
 
+        # Handle quarantine operations using QuarantineManager
+        if operation.operation_type == "quarantine":
+            if not self._quarantine_manager:
+                error_msg = "Cannot rollback quarantine: QuarantineManager not available"
+                log_operation(
+                    self.logger,
+                    logging.ERROR,
+                    error_msg,
+                    operation_type="rollback"
+                )
+                return OperationResult(
+                    operation=operation,
+                    success=False,
+                    error_message=error_msg,
+                    executed_at=executed_at
+                )
+
+            # Use QuarantineManager to restore the file
+            if operation.destination_path:
+                restore_result = self._quarantine_manager.restore_from_quarantine(
+                    operation.destination_path
+                )
+                return OperationResult(
+                    operation=operation,
+                    success=restore_result.success,
+                    error_message=restore_result.error_message,
+                    executed_at=executed_at
+                )
+            else:
+                error_msg = "Cannot rollback quarantine: no destination path recorded"
+                return OperationResult(
+                    operation=operation,
+                    success=False,
+                    error_message=error_msg,
+                    executed_at=executed_at
+                )
+
         try:
             # For move/rename operations, reverse the direction
             # Original: source -> destination