Route the rebuild path graph.json replace through the fallback

Fixes issue 2689 for the main rebuild write site, the second of the
two watch.py call sites reported.

Same reasoning as the reconcile path: existing_graph was read a few
lines earlier in this same process for the same_graph comparison, so
a plain Path.replace can hit the VMware HGFS PermissionError this
issue reports. Both call sites in watch.py now route through the
shared os_replace_with_fallback helper that export.py, cache.py, and
install.py already use.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017qfdzgbA5KedGEjD1AayNh
(cherry picked from commit b01622eb9f)

graphify/watch.py

@@ -2067,7 +2067,12 @@ def _rebuild_code(
             (out / _HTML_STALE_MARKER).touch()
             from graphify.export import backup_if_protected as _backup
             _backup(out)
-            graph_tmp.replace(existing_graph)
+            # os_replace_with_fallback, not a plain Path.replace (#2689): this
+            # function read existing_graph a few lines up for the same_graph
+            # comparison, and on a VMware HGFS shared folder a replace over a
+            # destination read earlier in the same process raises
+            # PermissionError even on the same drive.
+            os_replace_with_fallback(graph_tmp, existing_graph)
             report_path.write_text(report, encoding="utf-8")
             labels_file.write_text(labels_json, encoding="utf-8")
             # Keep the membership signatures in step with the labels we just wrote.