fix: reject obfuscation path collisions

[johnson-ricon]

Finding

The corpus plan allowed a known readable path to target an already-existing obfuscated path. mv then overwrote that destination before staging. A duplicated manifest ID could likewise send two planned readable paths to one destination.

Fix

• reject existing known-ID destinations during planning, before mutation
• reject manifest IDs shared by multiple planned readable paths
• cover both stale/interrupted-state collision shapes

Validation

• mise run test test/obfuscate.bats (84 passed)
• all 8 configured codebase lint rules
• Bash syntax and git diff --check
• Fold pre-commit OK; pre-push had only expected new-branch and inherited unsigned-history warnings

[junior-ricon]

@johnson-ricon Thanks for the collision fix. During the follow-up review I found one remaining filesystem edge: Bash -e is false for a dangling symlink, so the destination guard could still allow mv to replace an existing link.

Under Or's approval I pushed signed commit 95c61d687ba3f5904123b5213d7d6d5de4e110ad directly to this fix-it branch. It extends the guard with -L and adds a regression proving both the readable source and dangling destination link survive. The focused 85-test suite, all eight lints, README, syntax, diff, and preflight checks pass locally. I'll wait for the refreshed hosted checks before merging this fix-it.