feat(rpc): spawn_transitional helper for async lifecycle ops

Introduces a new RPC-layer helper that bridges the synchronous
ContainerOrchestrator trait with RPC handlers that must return in <1s.

The helper flips the package state to a transitional variant
(Stopping / Starting / Restarting) in the StateManager so WebSocket
clients see the live label immediately, then tokio::spawns the
actual orchestrator call. On success it writes the final state; on
error it reverts to the pre-transition state and logs via
install_log().

The ContainerOrchestrator trait stays synchronous so the reconciler,
boot flow, unit tests, and chaos harness keep deterministic
behaviour. Async only lives in the RPC layer.

Not wired to any handler yet — Commit 2 consumes this helper.
Widens install_log visibility from pub(super) to
pub(in crate::api::rpc) so the new sibling module can reach it.

core/archipelago/src/api/rpc/package/install.rs

@@ -16,7 +16,7 @@ use tracing::{debug, info, warn};
 const INSTALL_LOG: &str = "/var/log/archipelago-container-installs.log";
 
 /// Append a timestamped line to the persistent install log.
-pub(super) async fn install_log(msg: &str) {
+pub(in crate::api::rpc) async fn install_log(msg: &str) {
     use tokio::io::AsyncWriteExt;
     let ts = chrono::Utc::now().format("%Y-%m-%d %H:%M:%S UTC");
     let line = format!("[{}] {}\n", ts, msg);

core/archipelago/src/api/rpc/package/mod.rs

@@ -8,5 +8,6 @@ mod stacks;
 mod update;
 mod validation;
 
-// Re-export items needed by sibling modules (container.rs, security.rs)
+// Re-export items needed by sibling modules (container.rs, security.rs, transitional.rs)
 pub(super) use validation::validate_app_id;
+pub(in crate::api::rpc) use install::install_log;