Extract a shared isolated-load anchored byte publisher

[Infiland]

Child scope of #844.

Problem

scripts/build_dependency_snapshot.py already contains a robust anchored, hard-link/no-overwrite publication implementation, but it is embedded in a large dependency-snapshot CLI. Copying it into the receipt verifier would create two security-critical implementations. Directly importing src.conversion.anchored_artifacts is unsuitable because its transaction has different replace semantics and python -I cannot import repository packages.

Scope

• Extract the snapshot output binding and no-overwrite byte-publication mechanics into one private stdlib-only scripts/_anchored_output.py module with neutral names and stable error codes.
• Load the exact sibling module from Path(__file__) via a small importlib loader so isolated-mode callers do not depend on sys.path mutation.
• Migrate build_dependency_snapshot.py without changing its JSON bytes, checkout-containment rule, existing-output rejection, CLI errors, or dependency graph behavior.
• Move/adapt the existing adversarial output tests to exercise the shared primitive directly, including BaseException and cleanup precedence.
• Add isolated-loader smoke coverage for every migrated caller. Record the bootstrap wrapper's pre-existing python -I limitation explicitly if it is not repaired in this slice.

Acceptance criteria

• One stdlib-only anchored output implementation owns the existing snapshot publication mechanics.
• Snapshot success and every existing failure code/side effect remain behaviorally identical.
• POSIX descriptor-relative and modeled/native Windows directory-binding tests retain their current coverage.
• Exact-path isolated loading works without adding the repository or scripts directory to sys.path.
• No receipt semantics change in this child.
• Pyright, Ruff, focused snapshot/architecture/workflow tests, and the full unit suite pass.

Non-goals

Do not create missing output parents, accept identical existing files, migrate atomic_write_receipt(), or broaden dependency schemas here.