Keep another process's downloads when opening a library (closes #105)

The download writer's temp files are now named .quak-<pid>-<random>.tmp.
removeLeftoverTempFiles moves from the backup into the download module and
deletes a .quak-*.tmp file only when the process ID in its name is no
longer running; the content cache calls it at open() instead of deleting
every temp file, so a download in progress in another process sharing the
cache survives. The README backup layout and TODO.md are updated.

Model: opus-5-5

README.md

@@ -516,10 +516,13 @@ Each original is copied to a temporary file named
 to disk, and renamed into place, so an original is either complete or absent,
 even after a power cut. A run that is killed can leave one of these temporary
 files behind; the next backup deletes those whose process is no longer running.
-Downloads and the content cache use the same scheme with `.quak-<random>.tmp`
-names. The rename replaces whatever was at the destination rather than writing
-through it: a symlink there is replaced, not followed, and the new file has the
-temporary file's permissions, not those of the file it replaced.
+Downloads and the content cache use the same scheme with
+`.quak-<pid>-<random>.tmp` names, and opening a library deletes those in the
+cache whose process is no longer running, so a download another process has in
+progress in the same cache is left alone. The rename replaces whatever was at
+the destination rather than writing through it: a symlink there is replaced, not
+followed, and the new file has the temporary file's permissions, not those of
+the file it replaced.
 
 ## TODO