fix(optuna): harden best-params I/O against deployment failure modes

fix(optuna): harden best-params I/O against deployment failure modes

Address three P2 review findings; the same latent behaviors were ported
from QuickAdapter to ReforceXY, so all fixes are applied to both.

- Cross-uid save (C2): make owner preservation best-effort. A non-root
  process on a bind mount with a differently owned existing file lacks
  CAP_CHOWN; the fchown now swallows PermissionError (logged at debug)
  so the atomic write still completes, as the previous in-place write
  did. fchmod and the successful-chown path are unchanged.
- Read-only mount (C3): a shared (read) lock no longer forces O_CREAT.
  On a read-only mount where the lock file is absent, the load reads
  without a lock; os.replace atomicity guarantees a consistent read.
  Exclusive locks keep O_CREAT and still fail closed on read-only
  filesystems. S_ISREG/O_NOFOLLOW/O_NONBLOCK guards are preserved.
- Legacy warm-start (C1): a base-only legacy best-params file is now
  loaded when exactly one configured pair maps to that base (read in
  place, no rename, read-only safe). Ambiguous cases (more than one pair
  sharing a base) still warn and return None, preserving #180 safety.
  The configured pair list is threaded into the QuickAdapter module-level
  loader; a legacy payload still passes the same validation.