fix(session): a torn write no longer destroys the whole conversation

[ForkedInTime]

Phase 3 (data integrity & persistence, 5 files, 1,779 LOC). One real data-loss path; the rest of the phase checked out clean and is recorded as cleared rather than changed.

An interrupted append lost the entire session

Session::append writes JSONL and never fsynced, so a turn was reported as saved while the bytes could still be in the page cache. load_messages then parsed with .collect::<Result<_>>(), meaning any malformed line failed the whole load.

Together those are a total-loss path: a crash or power-cut mid-append leaves a half-written final line, and the next /resume fails outright — losing the entire conversation, which is the one thing sessions exist to prevent.

• append now fsyncs, so a completed turn is durable rather than merely buffered.
• load_messages tolerates a torn final line — dropped with a warning, the rest loads. Losing one turn beats losing all of them.

Corruption anywhere other than the last line remains a hard error, deliberately. Silently skipping a middle line could drop a tool_use while keeping its tool_result, which the API rejects outright — a subtly broken conversation is worse than a clear error. The message now names the offending line.

Parsing moved into parse_message_lines so the behaviour is testable against an explicit file rather than the global sessions directory.

Session export was not atomic

export used a direct fs::write, which truncates first — an interrupted export left an empty file where the transcript was. Now uses the same atomic_write as the session files.

Checked and cleared, not changed

• Compaction cannot break tool_use/tool_result pairing. snip_compact never removes blocks — it replaces ToolResult content with a placeholder and leaves structure intact. This was the sharpest risk on the phase plan (a mismatch is a hard API 400 that bricks a session) and the design is already correct.
• memory.rs durability is SQLite's, not a hand-rolled write path.
• memory.rs SQL is fully parameterised, LIMIT included. No injection.
• SessionMeta::save and overwrite already use atomic_write from an earlier audit — only append and export had been missed.

QA (triple-checked)

• 606 tests, 0 failures
• Clippy clean under the exact CI command
• Zero panics in production code across all five Phase 3 files
• Phase 1 and Phase 2 suites re-run green — no regressions
• Release builds, 19.08 MB

The torn-line fix verified by restoring the intolerant collect(), which fails 2 tests.