Issue #93: Export: never overwrite an original; atomic writes

- lightcraft_catalog::safe_file: one tested helper for crash-safe writes
  (temp file in the same folder, sync, rename, folder sync; temp removed on
  failure), write_new/write_new_unique that never replace a file and read
  the result back, same_file, and a per-thread fault injection for tests.
- engine::originals::OriginalGuard: refuses a write whose target is a
  catalogued photo's original or XMP sidecar (by file identity), whatever
  the conflict policy or exact path. Used by run_batch (export, Export with
  Previous, control/MCP exact paths), ui.render/ui.screenshot paths, merge
  previewPath, MCP render_photo/screenshot paths (new query command
  export.checkTarget) and lightcraft-cli render.
- The conflict policy now covers an export's sidecars together with the
  file (Unique gives both the same free name, Skip skips when either is
  taken).
- export::write_file replaces the plain std::fs::write in the desktop app,
  CLI, MCP and engine writers; XMP sidecar writes use the shared helper.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/lightcraft-cli/tests/cli.rs

@@ -86,6 +86,24 @@ fn render_subcommand() {
     assert!(String::from_utf8_lossy(&o.stderr).contains("unknown control"));
 }
 
+/// Issue #93: `render IMG -o IMG` replaced its own input with the render.
+#[test]
+fn render_refuses_to_overwrite_its_input() {
+    let input = tmp("self-in.png");
+    gradient_png(&input);
+    let before = std::fs::read(&input).unwrap();
+    let dir = input.parent().unwrap();
+    std::fs::create_dir_all(dir.join("sub")).unwrap();
+    let other_spelling = dir.join("sub/../self-in.png");
+    for out in [&input, &other_spelling] {
+        let o =
+            Command::new(BIN).args(["render", input.to_str().unwrap(), "-o", out.to_str().unwrap(), "--set", "light.exposure=1"]).output().unwrap();
+        assert!(!o.status.success());
+        assert!(String::from_utf8_lossy(&o.stderr).contains("never writes over an original"), "{}", String::from_utf8_lossy(&o.stderr));
+    }
+    assert_eq!(std::fs::read(&input).unwrap(), before, "the input is untouched");
+}
+
 #[test]
 fn render_export_options() {
     let input = tmp("o-in.png");