[VibeSWE]

Queries can select a staged Parquet file just before upload cleanup unlinks it, producing a missing-file error during execution. They can also select both the staged and uploaded copy. Capture same-filesystem hard links before refreshing the remote snapshot, retain them through native DataFusion plans and streams, and exclude staging copies already selected from the remote manifest.

The native Parquet reader, statistics and pushdowns remain in use. Shared validation preserves the uploader's corrupt/empty-file skip behavior; capture I/O errors fail explicitly. OS locks protect active leases and allow query capture to reclaim leases left by killed processes.

Validation: all 14 staging_lease tests pass, including an unleased-plan failure control, exact count/sum after original deletion, native repartitioning, stream lifetime/cancellation, setup failure rollback, and a separate-process kill/reclaim test. The broader query-provider suite also passes: 42 passed, 1 ignored. Fresh independent review approved the revised implementation. Formatting and diff checks pass.

Tradeoffs and limits are documented in docs/staging-query-leases.md: hard-link support is required; unique paths reduce footer-cache reuse; standalone staging-window scans add a metadata GET; Query/Prism snapshot errors now fail closed. A source disappearing before capture still produces an explicit error. Memory-to-Parquet publication and its existing overlap window require the separate conversion-visibility fix. This PR is independent of the Prism UI removal.

Review follow-up: orphan reclamation is deferred until the next query capture, avoiding filesystem work under the global stream registry lock. The new regression failed before the fix and passes afterward. Deduplication assumes a stable partition layout; concurrent partition configuration changes remain a documented limitation.