fix: harden repair backup scope and migrate swap rollback

- repair.py: define backup_path before the conditional block so it is
  always in scope when the except handler references it
- migrate.py: restore old palace from .old if both os.rename and
  shutil.move fail during the swap step

mempalace/migrate.py

@@ -239,8 +239,11 @@ def migrate(palace_path: str, dry_run: bool = False, confirm: bool = False):
     try:
         os.rename(temp_palace, palace_path)
     except OSError:
-        # os.rename fails across filesystems; fall back to move
-        shutil.move(temp_palace, palace_path)
+        try:
+            shutil.move(temp_palace, palace_path)
+        except Exception:
+            os.rename(stale_path, palace_path)
+            raise
     shutil.rmtree(stale_path, ignore_errors=True)
 
     print("\n  Migration complete.")

mempalace/repair.py

@@ -254,8 +254,8 @@ def rebuild_index(palace_path=None):
 
     # Back up ONLY the SQLite database, not the bloated HNSW files
     sqlite_path = os.path.join(palace_path, "chroma.sqlite3")
+    backup_path = sqlite_path + ".backup"
     if os.path.exists(sqlite_path):
-        backup_path = sqlite_path + ".backup"
         print(f"  Backing up chroma.sqlite3 ({os.path.getsize(sqlite_path) / 1e6:.0f} MB)...")
         shutil.copy2(sqlite_path, backup_path)
         print(f"  Backup: {backup_path}")