Implement a more resilient scheme for rotating the manifest.

Previously, when rolling over a manifest, we would write it to a temp file,
delete the current manifest and then rename the temp file over to the
manifest file name.

The new scheme is to keep two copies of the manifest at all times. We offset
the rotation counter so they don't rotate at the same time. Then instead
of deleting the file and renaming, we simply truncate the existing manifest file
and write the new manifest over it. If anything fails, we can get the manifest
from the other copy.

Another change is to open the file in WriteThrough mode, so no caching occurs.
This should be the same as a Write followed by a Flush, but it may be more reliable.

We pre-contruct the entire manifest contents and write in a single block to prevent
cacheless write from dragging down performance. After changing the writes to async
writes, this complete change appears to be both more resilient to failures as well as
quite a bit faster.

[#48200043]