fix: patch copied files in place for prefix replacements

[TTTPOB]

Summary

• switch patched-file installs to copy first and then patch the destination in place
• temporarily add owner-write access before patching copied read-only files, then restore the original permissions afterward
• preserve the existing mtime/codesign behavior and add focused tests for same-length, resized, and read-only patched files

Closes #2282

Testing

• CARGO_HOME=/tmp/cargo-container cargo fmt --all --check
• CARGO_HOME=/tmp/cargo-container CARGO_TARGET_DIR=/tmp/rattler-target cargo test -p rattler test_patch_copied_destination_updates_only_changed_ranges_when_lengths_match --lib -j1
• CARGO_HOME=/tmp/cargo-container CARGO_TARGET_DIR=/tmp/rattler-target cargo test -p rattler test_patch_copied_destination_rewrites_from_first_difference_when_length_changes --lib -j1
• CARGO_HOME=/tmp/cargo-container CARGO_TARGET_DIR=/tmp/rattler-target cargo test -p rattler test_patched_read_only_file_restores_permissions --lib -j1
• CARGO_HOME=/tmp/cargo-container CARGO_TARGET_DIR=/tmp/rattler-target cargo test -p rattler test_patched_file_receives_modification_time --lib -j1
• CARGO_HOME=/tmp/cargo-container CARGO_TARGET_DIR=/tmp/rattler-target cargo test -p rattler test_unpatched_file_keeps_source_mtime --lib -j1