Reject race-created shard output destination #496

Source: #477

Bug

merge_shards validates that output_run is absent before copying, but _mkdir_private_tree accepts an already-existing directory. A competing process can create the final destination between validation and directory creation; the merge then writes into that competing directory instead of preserving the previous no-clobber behavior.

Expected

The final output_run leaf must be created exclusively by this merge. Race-created ancestors may be accepted only where intended; a race-created final leaf must fail without copying or publishing files.

Acceptance

• Add a deterministic focused regression for the validation-to-create race.
• Restore exclusive final-leaf creation while preserving recursive private 0700 ancestor creation.
• Keep the destination free of merged files on rejection.

Review source: #477 (comment)