Keep retained-release recovery outside temporary staging and restore it when the verified replacement cannot be moved into place. Preserve the backup for manual recovery if the restore also fails.

Regression tests reproduce the lost rollback copy and verify both recovery paths. Documentation: update managed CLI usage and development guidance plus Unreleased. TODO is unchanged because this fixes existing private-installer behavior, not a tracked parity gap.