File race in download_url() when parallel threads download the same monorepo sdist

[smoparth]

In build-parallel, when multiple sub-packages share the same monorepo sdist (e.g., MLServer runtimes like mlserver-sklearn, mlserver-lightgbm), they can land in the same topological level and all try to download the same tarball simultaneously. The first thread to finish renames the .tmp file, and the others fail with:

[Errno 2] No such file or directory: '.../downloads/mlserver-v1.7.1.tar.gz.tmp' -> '.../downloads/mlserver-v1.7.1.tar.gz'

Root cause
sources.py download_url() uses a shared temp filename (outfile + ".tmp") for all threads downloading the same file. Thread A downloads and renames it; Thread B's rename fails because the .tmp is already gone.

[tiran]

There are actually two bugs:

• every package/version combination should use a unique, PEP 625 compatible file name. PR fix(sources): PEP 625 sdist name by default #1151 fixes the problem for packages without a destination_filename option.
• Fromager should not write downloads into the destination directory directly. Instead sources and wheels should be downloaded into a temporary subdirectory and then moved into the destination with atomic os.rename or hard-link + unlink. Either the subdirectory or name must be random and exclusive. It has to be a directory on the same mount point, because atomic rename does not work across mounts.