fix workspace output and cleanup uncertainty

tools/thothctl/internal/workspaceops/operations.go

@@ -654,6 +654,9 @@ func publishCandidateBytes(x *hostExport, result Result, path string, b []byte)
 		return nil
 	}
 	if err := safeio.WriteCanonicalExclusive(path, b, 0o600); err != nil {
+		if errors.Is(err, safeio.ErrIndeterminateFile) {
+			return errors.New("candidate output state is indeterminate; reconcile the destination and private stages before retrying")
+		}
 		return errors.New("unsafe output file")
 	}
 	return nil