werkdock store: reserve the .tmp suffix, List skips staging leftovers

The image-name pattern allows dots, so a directory like broken.tmp —
an interrupted load's staging dir — counted as an image. List now skips
.tmp names and Load refuses them, closing the ambiguity the previous
commit's (accidentally pushed red) test exposed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/store/store.go

@@ -70,7 +70,7 @@ func (s Store) List() ([]string, error) {
 	}
 	var names []string
 	for _, e := range entries {
-		if e.IsDir() && nameRe.MatchString(e.Name()) {
+		if e.IsDir() && nameRe.MatchString(e.Name()) && !strings.HasSuffix(e.Name(), ".tmp") {
 			names = append(names, e.Name())
 		}
 	}
@@ -86,6 +86,11 @@ func (s Store) Load(archive, name string) error {
 	if !nameRe.MatchString(name) {
 		return fmt.Errorf("invalid image name: %q (allowed: lowercase letters, digits, '.', '_', '-')", name)
 	}
+	// ".tmp" is the staging suffix of this very function — a legal-looking
+	// image name ending in it would collide with interrupted loads.
+	if strings.HasSuffix(name, ".tmp") {
+		return fmt.Errorf("invalid image name: %q (the .tmp suffix is reserved for staging)", name)
+	}
 	archiveAbs, err := filepath.Abs(archive)
 	if err != nil {
 		return err