Keep shard output leaf exclusive

[Anionix]

Fixes #496

Follow-up to merged PR #477.

Contract

• Create every missing output ancestor explicitly with requested mode 0700.
• Create the final shard output leaf exclusively.
• Reject a final leaf created after merge validation and before publication.
• Copy or publish no files into a rejected competing destination.

Verification

• Regression: a race-created final leaf raises FileExistsError and remains empty.
• Focused shard suite: 16 passed.
• Ruff: PASS.
• git diff --check: PASS.
• Targeted correctness/scope review: PASS.
• Lean: NO_LEAN; atomic directory creation is an executable Python/OS boundary.

Exact SHA: ad3e8c33d44426e69167db7dbedfbe08f8bd8ea4

Primary source:

• https://docs.python.org/3/library/pathlib.html#pathlib.Path.mkdir