descriptor: make add_file_descriptor_set transactional

[fallintoplace]

Summary

DescriptorPool::add_file_descriptor_set now stages work in a cloned pool and only commits the result after every registration and link pass succeeds.

Why

The existing implementation could mutate by_name, placeholder messages/enums, and other lookup tables before a later pass returned an error. That left the pool in a partially loaded state after a failed add, which is especially risky when descriptor sets come from runtime input.

What changed

• wrap add_file_descriptor_set in a transactional clone-and-commit path
• keep the no-op fast path for re-adding already loaded files
• add a regression that proves a failed add leaves the pool unchanged and that retrying with a corrected descriptor set succeeds

Validation

• cargo test -p buffa-descriptor --features reflect

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}