feat: replace local VPKs without duplicating mods

[oldreceipt]

Re-importing an updated local VPK currently creates another mod. This adds Replace VPK to local mods and variants, plus a reviewed replacement choice when an imported VPK matches an installed name. Adding a separate mod remains the default; names never silently select an overwrite target.

Replacement preserves the installed slot, enabled/Global state, presentation, variant group, and profile ownership. It validates and stages one standalone VPK, checks the reviewed file's physical hash and fresh game state before swapping, and restores the original on a failed commit. Files carrying conflicting GameBanana/merge identity must be imported separately. General archive/group updates are outside this change.

Validation:

• GitHub CI passes on Ubuntu, including the full test suite and build.
• Typecheck, lint, production build, locale check, and generated-manifest check pass in this isolated branch.
• 94 replacement/import/profile regression tests pass; four additional renderer interaction tests cover fingerprint preparation, selection races, and failure handling.
• Full Windows suite: 1,303 passed, 12 failed, 15 skipped; also a steamRoots suite setup failure. Failures are the existing six CRLF fixture round trips and Windows-incompatible Wine/pgrep/symlink fixtures. The CRLF failures were reproduced against the unchanged base.
• Inspected the actual replacement and matching-name controls in an isolated browser preview. No real installed mods were changed for testing.

This PR targets this fork's main and is independent of the personal-convars PR. Regenerate the locale manifest when combining both changes.