Test hygiene: install_script fixture collision on macOS, source_import lock flake, leaked production-build directories

[jeremi]

1. crates/registry-breg/tests/install_script.rs: InstallerFixture::build names the fixture root by process id and SystemTime::now().as_nanos(). macOS reports CLOCK_REALTIME at 1 µs resolution, so glibc_at_the_floor_installs_both_commands and glibc_below_the_floor_refuses_before_installing, which do the same file read before building their fixtures, can share a root. The below-the-floor installer exits at the preflight, its fixture's Drop removes the shared root, and the at-the-floor installer reports "Could not read the published breg v9.8.7 binary for linux/amd64". Observed: 5 failures in 30 runs of the two tests together, 0 in 30 runs of the failing test alone, 0 in 20 runs with --test-threads=1. Fix in the test: a process-wide counter or a tempfile directory in the root name.
2. interrupted_replacement_and_baseline_advance_restore_the_complete_prior_state (crates/registry-evidencectl/src/source_import/tests.rs) failed once on its final assert!(ProjectLock::acquire(&fixture.project).is_ok()) during a whole-crate run under CPU contention, and did not reproduce in 20 solo runs or 30 runs as two concurrent loops. The assertion discards the error, so the cause is unknown. Make the assertion report the error and rerun under contention.
3. crates/registry-evidencectl/tests/production_build.rs creates target/production-build-* directories (tempfile prefix production-build-) that outlive the run; 30 were left behind after a few local runs. Use a directory removed on drop, or clean up in the test's teardown.

Origin: review of PR #865 (items 1 and 2 seen in the local gate runs; item 3 predates the PR).

[jeremi]

Two more of the same kind, both pre-existing on main (seen while reviewing PR #851; neither is caused by it):

4. crates/registry-manifest-cli/tests/cli.rs: temp_dir(name) creates $TMPDIR/registry-manifest-<name>-<nanos> and nothing in the file removes it (no remove_dir_all, no drop guard), so every run leaves one directory per call behind: a dozen validate-* and publish-* directories per full run. Same fix as item 3: a directory removed on drop.
5. crates/registry-bregctl/src/data_lifecycle.rs: test_directory(label) creates .bregctl-data-test-<pid>-<label>-<n> under the current directory (the crate root under cargo test) and each test removes it with fs::remove_dir_all(...).unwrap() at its end. A failing assertion skips that line, so a red test leaves its directory in the crate checkout, where git status shows it as untracked. The nanos-free name and the counter are fine; only the cleanup needs to survive a failure.