fix(agentpool): close truncate-then-read race in agent_jobs.json persistence

[localai-bot]

Summary

• Replaces os.WriteFile in fileJobPersister with a same-directory temp file + os.Rename. POSIX rename is atomic, so concurrent readers see either the prior contents or the new contents — never the zero-byte window that O_TRUNC exposes.
• Collapses AgentJobService.{Load,Save}{Tasks,Jobs}{FromFile,ToFile} to thin wrappers over fileJobPersister, removing the duplicate write path and the redundant service.fileMutex / service.tasksFile / service.jobsFile fields.

Why

Three call sites wrote and read agent_jobs.json through three different mutex instances:

#	Site	Mutex
1	go saveJobs(job) spawned from ExecuteJob -> fileJobPersister.saveJobsToFile	fileJobPersister.mu
2	AgentJobService.SaveJobsToFile	service.fileMutex
3	AgentJobService.LoadJobsFromFile on a second service instance	a different service.fileMutex

Nothing serialized them, and both writers used os.WriteFile (which opens O_WRONLY|O_CREATE|O_TRUNC). A reader that landed between the truncate and the write saw a zero-byte file and surfaced as failed to parse jobs file: unexpected end of JSON input at offset 0.

The macOS tests-apple job started hitting this every push once paths-ignore was dropped from .github/workflows/test.yml in 6d2b7d8; run 25823124797 was the first observed failure. The race has existed since #9124 (the file persister was introduced); it just took more sample runs on macOS for the scheduler to land in the bad window.

The combination here closes both axes:

• Inside one service, all save paths now share fileJobPersister.mu, so the async saveJobs goroutine and an explicit SaveJobsToFile serialize against each other.
• Across two service instances pointing at the same file (the bootstrap and test patterns), the atomic rename guarantees readers never see a partial file.

Test plan

• New regression spec does not surface a partial file when saves and loads race hammers SaveJobsToFile and LoadJobsFromFile concurrently across two service instances for 500 ms; on master this reproduces the exact macOS error on Linux within that window, on this branch it passes.
• go run github.com/onsi/ginkgo/v2/ginkgo --until-it-fails --focus="does not surface a partial file" ./core/services/agentpool/ — 54 attempts in 30 s, all green.
• go test -race ./core/services/agentpool/... clean.
• golangci-lint run --config=.golangci.yml ./core/services/agentpool/... clean.
• Full ./core/services/agentpool/... suite (52 specs + the new one) passes.