auditwheel: copy unpatched cargo output back before in-place patching

[messense]

fs::rename in finalize_staged_artifacts to skip the full byte copy on ext4. The trade-off was that whenever auditwheel / delocate / delvewheel actually rewrote bytes (DT_NEEDED, Mach-O load commands, PE imports, RPATH), the cargo output path was left empty (same-fs) or holding the unpatched original (cross-device), and the staged copy was never restored — see #2969 for why patched bytes must not flow back to cargo's incremental cache. Tools and CI scripts that read target/<target>/release/<bin> after a patched build saw a missing or stale file.

Restore the invariant that the cargo output path always holds the clean unpatched bytes after a successful build, while keeping the rename-back fast-path for the unpatched case.

The repair pipeline now splits into a detect step and a patch step:

• New PatchKind<'a> enum carries the per-call context (Repair { grafted, libs_dir, artifact_dir } or Editable) and is used by both prediction and execution.
• New WheelRepairer::patch_required(audited, kind) -> Vec<bool> predicts, before any bytes are rewritten, which audited artifacts the upcoming patch call will modify in place. Conservative defaults: all-true on Repair, all-false on Editable. ElfRepairer overrides the editable arm to track linked_paths.is_empty() per-artifact so multi-bin editable builds where only some bins carry cargo-target search paths still get the cheap rename-back for the rest.
• WheelRepairer::patch_editable is folded into patch via PatchKind::Editable, removing the parallel API surface.
• New copy_back_cargo_outputs helper in build_context/repair.rs reflinks/copies the still-clean staged artifact back to its cargo output path for every will_patch[i] == true entry, then take()s cargo_output_path so finalize won't overwrite the unpatched bytes with the patched ones. Cross-device staging is a no-op (the original is already at the cargo path); same-filesystem staging pays one reflink per genuinely-patched artifact (O(1) on apfs/btrfs/xfs/refs, a real copy on ext4) — same cost as the pre-perf: defer stage_artifact copy-back, finalize via rename when unpatched #3155 worst case, but scoped only to artifacts that actually need patching.
• add_external_libs calls patch_required then copy_back_cargo_outputs then patch on both the editable and non-editable branches. The unconditional cargo_output_path = None clearing loop is gone — clearing is now per-artifact and happens in the helper.

Net effect:

• Unpatched artifacts: identical to today — single rename-back in finalize_staged_artifacts.
• Patched artifacts (same-fs): one reflink/copy at patch time instead of the rename-back; cargo output ends up with unpatched bytes.
• Patched artifacts (cross-device): zero extra I/O — stage_file already left the unpatched original at cargo output.

Public auditwheel types (AuditedArtifact, GraftedLib, AuditResult, PatchKind) now derive Debug for consistency with the rest of the public surface.

The follow-up commit tightens each platform's patch impl to skip artifacts whose external_libs is empty (ELF: skip set_rpath; Mach-O: filter install_name_changes per-artifact and skip patch_macho + ad_hoc_sign when the filter is empty; PE: filter replacements per-artifact case-insensitively against aa.external_libs[*].name and skip pe_patch::replace_needed when empty), and loosens the default patch_required for Repair to !aa.external_libs.is_empty(). The two changes ship together — tightening only the default would regress #2969, while tightening only the impls would just be dead-code elimination with copy_back_cargo_outputs still paying an unnecessary reflink for the now-unaffected artifacts.

Known limitation: dlopen-only dependencies

external_libs is populated by static dependency analysis (lddtree on the artifact's LC_LOAD_DYLIB / DT_NEEDED / PE import table). A library reached only via runtime loading — dlopen("libfoo.so", ...), dlsym, LoadLibrary — won't appear in external_libs, so its host artifact gets will_patch = false and is skipped by the tightened patch impls.

For Mach-O install-name rewriting and PE import-table rewriting this is benign: a dlopen doesn't go through the load command / import table, so rewriting them was a no-op anyway. ELF DT_NEEDED rewriting was already gated on aa.external_libs pre-PR for the same reason.

The new behavior in this PR widens the gating to ELF RPATH append: pre-PR, every audited artifact got $ORIGIN/<dist>.libs appended unconditionally; post-PR, only those with non-empty external_libs do. Practically: a Linux extension that statically depends on nothing but dlopens a library bundled by some other artifact in the same wheel will now lack the RPATH and fail at runtime. Workaround: declare a static dependency on at least one bundled lib (so the artifact gets the auto-RPATH), or set the RPATH manually via cargo:rustc-link-arg=-Wl,-rpath,$ORIGIN/<dist>.libs.