Audit 2026-10-08: atomic output writes, Python 3.13 in CI

[jehrr]

Two findings of the 2026-10-08 audit that held up against the code at 2a8517d.

• Non-atomic writes (confirmed): write_json/write_csv/sidecar opened the target with w. Now temp file in the same directory + fsync + os.replace, mode preserved (a bare NamedTemporaryFile would leave 0600). Control: reverting write_json to in-place turns the suite red on "a failed write leaves the previous file byte-identical" and "no writer opens its target for writing in place".
• Python 3.13 untested (confirmed): README says 3.9-3.13 "both ends tested"; matrix was 3.9 + 3.12. Now 3.9 + 3.13. Offline suite passes locally on 3.13.5.

Not changed, and why:

• Console scripts / lock files: the family runs scripts from a clone by design; lock files would disable the canary's daily test of new upstream releases.
• Dropping engines: the three-engine contract is family-wide (parity is tested); Selenium/pyppeteer limits are already documented in the README.
• "Scraper API is a misleading entry point": the README table already records it as refused (Incapsula interstitial, exit 3).
• Live run: blocked from this datacentre address without a UAE exit, which the repo documents; not a defect.

🤖 Generated with Claude Code