fix(infra): persist a recovery record before parsing the create response

Latitude accepts the billable POST /servers before provision.sh parses the id, so
an accepted-but-malformed response previously aborted with no local record (WORK_DIR
is removed on exit). The raw response is now saved to STATE_DIR/last-created-server.json
at mode 0600 immediately after the 201, so a potentially-billed host can always be
identified and torn down.