hardening: post-v0.14 I/O, setup, and edge-case follow-ups

[subinium]

Context

The v0.14.0 release audit cleared all identified P0/P1 blockers. These lower-severity follow-ups were intentionally kept out of the release-critical patch set, but should remain tracked for a 0.14.x hardening pass.

Follow-ups

• Prime Agent deletion is fail-closed, but the common TUI Delete action can still appear and return without a useful unsupported message.
• Structured/list/stats stdout paths do not all share one broken-pipe-safe error contract; some writes are ignored and some println paths can panic.
• Shell setup read-modify-write has no cross-process coordination, and atomic writes do not fsync the parent directory before reporting durable success.
• Saving settings after malformed TOML can replace unrelated user settings instead of preserving the original file and reporting the parse error.
• Cache fingerprints can miss exotic same-path/same-size/same-mtime replacements and nested symlink-target changes.
• OpenCode/Hermes SQL title aggregation should bound source content before materializing it, not only truncate after allocation.
• CSV output should document or implement spreadsheet formula-injection neutralization for fields beginning with formula sigils.
• Watch should report running state as unknown on unsupported Windows backends and should persist successful refreshed state consistently.
• Hermes sessions with an empty project path should disable the Cd action instead of previewing it as unavailable and later producing an empty-directory command.

Acceptance criteria

• Each behavior has a focused regression test, including Windows where platform-specific.
• I/O failures are surfaced without corrupting settings, cache, or terminal state.
• Allocation bounds are applied before SQLite/Rust materialization.
• Unsupported actions are disabled or provide explicit feedback.
• fmt, Clippy with warnings denied, MSRV, RustSec, Linux tests, and Windows tests pass.

[subinium]

v0.15.0 integration update

Merged in #91 (7a426265b49cd9757cb111902abc8fdfa34536e9), with 18 unchanged-source
local gates and all nine PR and merged-main CI jobs passing. Release publication
is a separate gate and is not asserted by this comment.

Covered:

• Unsupported native-managed deletion and empty-cwd actions stay unavailable;
  dispatchers reject unsupported operations as well.
• List/stats output propagates write and flush failures, with BrokenPipe handled
  separately at the CLI boundary.
• Invalid/unreadable settings are preserved; diagnostics do not echo raw TOML
  values. Atomic writes sync the file and the parent directory on Unix and
  preserve existing permissions.
• Followed file-symlink target identity/metadata participates in fingerprints;
  failed/incomplete refreshes preserve stale data for retry.
• OpenCode/Hermes title query source length and child counts are bounded before
  SQLite aggregation/materialization.
• Watch retains unfiltered refreshed cache data and exposes unknown process
  state on unsupported inspection backends.
• CSV documentation explicitly preserves raw values and warns spreadsheet
  consumers to import untrusted fields as text; no silent neutralization claim.

Still open: cross-process shell-setup writer coordination and metadata-preserving
same-size/same-mtime replacement edge cases. Directory symlinks are not recursively
followed. Unix parent-directory fsync is not a claim of equivalent Windows crash
durability. These boundaries must not be inferred as solved by the release.