Protect collection sources and preserve outputs on failed export

[lukisch]

Choosing a collection input as the output previously overwrote that source, and a failed direct save could destroy an existing report. Export now snapshots inputs, rejects resolved-path and file-identity aliases before conversion and publication, writes into a private directory beside the destination, reopens the PDF to verify its page count, and replaces the destination only after validation.

Output-directory failures return the existing typed error result. Empty output documents are closed, and a cleanup error after successful publication reports the completed export rather than a misleading failure.

Validation at final candidate 95b5b73f16a4b2e9f082611be5db1444b81d8463, including main a49529b: baseline 12 failing regression cases; final local full suite 480 passed, 1 missing-local-MSIX skip. Regression coverage includes actual PyMuPDF output, hardlinks, late aliases, interrupted writes, invalid PDFs, PNG disguised as PDF, replacement failure, identity-check permission failure, empty-document closure and postpublication cleanup. Ruff, actionlint and diff checks passed. CI 36869658628 passed all six Windows/Linux/macOS × Python 3.11/3.12 jobs at this exact head; both collection suites and GUI smoke steps executed successfully. Its pre-existing Bash line continuations broke PowerShell before dependencies were installed; pip installation now uses a single portable command.

Output validation uses bytes and explicitly requests PDF format, avoiding leaked Windows file handles when malformed file parsing fails. The GUI smoke fixture destroys its own window while QApplication is alive and isolates settings in a temporary INI file. It processes deferred deletion only for its own window, preserving widgets from other tests. Independent final acceptance: 36 export/native counterprobes and six GUI/ownership probes passed, all exit 0; the previous foreign-widget deletion failure was reproduced and repaired.

Merged normally as 6f6910a106bbc26d11fe2f30028eb63bb3f20428; merge and reviewed candidate have the same tree ca2e63b2aab75f5166ef81e5da4c61ca7a531fe4. Canonical main is clean and matches origin/main.

The existing Welcome New Contributors workflow failed because first-interaction v3 expects underscore input names. It is unchanged and was not rerun: it sends external greeting comments and is separate from source validation.

The final identity check and filesystem replacement are separate operations; protection against a concurrent external actor between them is not claimed. No version, installed binary or Store change.