[elezar]

Stacked on #5455, which is stacked on #5450. This diff is against #5455's branch.

Summary

The testkit program wrote junit.xml only after its last test, so a run-level timeout (45 minutes) lost the report and only the log survived.

• Rewrite the report after each test, so a run that is stopped from outside still leaves the results so far. A write error during the run is logged; the final write still decides the exit status.
• Write to <path>.partial and rename, so a kill during a write leaves the previous report, not a truncated one.

The test that is running when the run is stopped is not in the report, since it has no result yet.

Related Issue

Part of #5416 (this item came from the review of #5332; the issue stays open). Also resolves the junit.xml note on #5333.

Testing

• cargo fmt --check, cargo clippy --all-targets -- -D warnings and cargo test pass for tests/testkit.
• A new unit test checks that writing replaces the report and leaves no partial file.
• No e2e lane was run.