fix(format): atomic file overwrite with cross-platform support

[narukoshin]

Added Unix and Windows support to overwrite a file safely.

[github-actions]

AI Code Review

1. Sensitive data disclosure

✅ No issues found

• No credentials, API keys, personal information, or sensitive paths appear in the diff.

---

2. Merge conflicts

✅ No issues found

• No conflict markers present.

---

3. Correctness

⚠️ Issues present
🟠 High: replaceFile doc comments ("replaces the file at source with the file at destination") in both format_unix.go and format_windows.go are misleading: the function arguments are source, destination, but the code calls os.Rename(source, destination) (Unix) and MoveFileEx(sourcePtr, destinationPtr, flags) (Windows), which actually replace the file at the destination path with the source content. The wording should clarify this or be changed to "replaces the file at destination with the file at source".
🟡 Low: Path() refuses to format symlinks (good), but doesn't handle hard links or read-only files. For hard links, overwriting via rename replaces all links, which may be desirable but not always expected; for read-only files, error handling is correct (will error out).

• Edge-cases appear reasonably handled: identical content no-op, temporary file is created in same directory (atomic), cleanup is handled via defer.
• File permissions are copied correctly.
• Temporary file cleanup is robust.
• No obvious correctness flaws otherwise.

---

4. Cross-platform

✅ No issues found

• Proper split with +build windows and !windows.
• Windows uses MoveFileEx with REPLACE_EXISTING and WRITE_THROUGH; Unix uses atomic os.Rename.
• Works as expected on macOS, Linux, Windows.
• No bash scripts are in the diff.

---

5. Bash quality

✅ No issues found

• No bash or shell scripts in the diff.

---

6. Security

✅ No issues found

• No hardcoded secrets.
• Path injection risk mitigated: temp file is created in original directory, filenames are deterministic with safe patterns.
• Proper error handling and cleanup.

---

7. Code quality

⚠️ Issues present
🟡 Low: The temp file pattern pattern := "." + filepath.Base(path) + ".tmp-*" uses a leading dot, which is fine, but arguably a magic string. Consider using a const for the temp pattern prefix if reused elsewhere.
🟡 Low: Doc comments as noted above are potentially misleading.

---

8. Dependencies

✅ No issues found

• golang.org/x/sys is necessary for MoveFileEx on Windows.
• Dependency is appropriately scoped.

---

9. Documentation

🟡 Issues present

• The doc comment for replaceFile is misleading regarding argument order and effect (see above).
• No separate documentation updates; however, all function comments in code are updated.
• PR documentation is otherwise sufficient.

---

10. PR scope

✅ No issues found

• Single concern: atomic overwrite with cross-platform support.

---

📝 AI Recommendation: APPROVE WITH NOTES

---

AI-generated advisory review. All verdicts are recommendations only — the final merge decision rests with the human maintainer.