test: lock atomic evidence replacement

[Ymax27]

Summary

• Adds tests for atomic_write_text().
• Parent directories are created, an existing file is replaced completely, the temporary sibling is removed, and an fsync OSError still leaves the new content in place.
• No production behavior changes.

Scope

Fixes #27.

Validation

Commands run on this branch:

PYTHONPATH=src python3 -m pytest -q tests/test_file_safety.py

Observed result: 2 passed.

ruff and mypy are not installed in this environment, so those gates were not run.

Checklist

• CLI changes are safe by default and documented.
• New detection behavior includes tests.
• False-positive filtering remains conservative by default.
• Observations/probes are preserved even when findings are filtered.
• Evidence schema and proof-gate mutation tests pass.
• No destructive payloads or denial-of-service behavior were added.
• I reviewed the final diff and can explain the changes I am submitting.
• Validation results in this PR are from commands actually run on this branch; no results or evidence were fabricated.
• Any assumptions I could not verify are stated explicitly instead of being presented as facts.

Made with Cursor

[tayfuryldz]

I checked this against current main and ran the full maintainer gates locally: pytest, Ruff, and mypy are clean. The diff stays within the issue scope and I did not find a blocking regression.