fix(model-install): preserve install tmpdir when a single multi-file part fails

[lorenzozanee]

Summary

A single part error in a multi-file install deletes the entire install tmpdir. A transient failure on one file (an HTTP 5xx, or the sidecar rename race from #9432) discards parts that already completed and .downloading partials holding resumable progress, so the next attempt restarts the whole install from zero.

The error path now preserves the tmpdir when it contains anything worth keeping (a completed part file or a non-empty partial): the install is marked paused and the install marker is persisted, so restarting failed files and resume can pick up where the download left off. When nothing on disk is worth keeping, the tmpdir is still removed as before.

Related Issues / Discussions

Closes #9481

QA Instructions

New regression test (fails on the previous HEAD, passes with this change):

pytest tests/app/services/model_install/test_model_install.py::test_multifile_install_part_error_preserves_tmpdir

Surrounding suites and lint:

pytest tests/app/services/model_install/test_model_install.py tests/app/services/download/test_download_queue.py
uvx ruff@0.11.2 check invokeai/app/services/model_install/model_install_default.py tests/app/services/model_install/test_model_install.py

Result: 52 passed (35 model install, 17 download queue), ruff clean.

Merge Plan

Standard merge.

Checklist

• The PR has a short but descriptive title, suitable for a changelog
• Tests added / updated (if applicable)
• ❗Changes to a redux slice have a corresponding migration
• Documentation added / updated (if applicable)
• Updated What's New copy (if doing a release after this PR)

Supersedes #9488（原PR分支已删，按原提交重建）

[JPPhoto]

@lorenzozanee Thanks for this PR. I'd like you to address the following findings/issues and then re-request review from me:

• invokeai/app/services/model_install/model_install_default.py:1525: Auto-pausing writes no model-install event; frontend only logs download_error, so UI remains downloading with no recovery action. Effect: stale UI. Likelihood: normal multi-file 5xx failure. Recovery: manual refresh/reconnect. Test: assert client state changes to paused without refetch.

• invokeai/app/services/model_install/model_install_default.py:1525: After restart, an early resumed-part failure can overwrite the marker with empty files because install_job.download_parts is empty. ETag/Last-Modified are lost; the next Range request lacks If-Range and can silently append bytes from changed remote content. Effect: possible corrupt model. Likelihood: plausible after restart with an existing partial. Recovery: delete partial and reinstall. Test: restore paused marker with partial plus ETag, fail before _download_started_callback, then verify metadata survives and If-Range is sent.

• docs/src/content/docs/development/Architecture/model-manager.mdx:650: Docs still claim model installs never preserve partial downloads, now false. Effect: inaccurate recovery/storage guidance. Likelihood: normal recoverable multi-file failure. Recovery: update docs. Test: docs check must remove that claim.

Suggestions:

• Consider copying parent download parts into the install job before writing the paused marker.
• Consider emitting and handling a dedicated model-install paused event.