Make output publication fail closed

[Joona-t]

What changed

• adds staged, descriptor-owned output publication with atomic no-clobber/swap behavior
• refuses source/output aliases and implicit replacement
• adds explicit --force recovery retention and genuinely write-free --report-only
• documents limits and adds adversarial regression coverage

Why

Direct LUT/preview writes could truncate source media or overwrite existing output before validation.

Impact

GradeKit now fails closed around source collisions and concurrent destination changes. Forced replacement retains the prior artifact for manual recovery.

Validation

• fresh full suite: 55 passed
• prior independent tier-1 adversarial review passed, including 30 focused safety tests
• git diff --check and secret/path risk scan passed
• pre-existing IMG_7889.cube was excluded and remains local/untracked