fix(cli): harden legacy flow lock migration from #9555

[hugocasa]

Summary

Follow-up to #9555 addressing the two P2 nits from its automated review, hardening the one-time migration that renames legacy flow inline lock files (*.inline_script.deno.lock) to the canonical name (*.inline_script.lock).

Changes

• The legacy lock-file deletion loop now runs after the flow.yaml rewrite, so an interruption between the two can no longer leave flow.yaml referencing an already-deleted lock file.
• Added a collision guard: a legacy name that coincides with a file written in the current extraction (e.g. deno step x whose legacy lock x.deno.lock equals the canonical lock of a step summarized "x.deno") is never deleted.

Test plan

• bun test extractor/inline-script unit suite passes (34 tests)
• Mock-backend E2E of generateFlowLockInternal: legacy repo migrates in one run (canonical lock written, legacy removed, flow.yaml updated) with the new ordering
• Contrived flow where one step's canonical lock path equals another step's legacy lock path: the live file is preserved

🤖 Generated with Claude Code

---

Summary by cubic

Hardens the one-time migration that renames legacy inline lock files by rewriting flow.yaml before cleanup and guarding against path collisions. Prevents stale lock references and accidental deletion during migration.

• Bug Fixes
  • Delete legacy locks after the flow.yaml rewrite to avoid broken references on interruption.
  • Skip deleting a legacy path if it matches any path generated in the current extraction.

^{Written for commit 1ab4f6c. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying windmill with    Cloudflare Pages

Latest commit:	1ab4f6c
Status:	✅  Deploy successful!
Preview URL:	https://4c613abf.windmill.pages.dev
Branch Preview URL:	https://cli-flow-lock-migration-hard.windmill.pages.dev

View logs