Validate remediation before atomically replacing the output document

## Priority

P1 — correctness/security boundary before broader use

## Context

Portfolio audit follow-up (2026-09-08). The fix command writes the transformed file before preservation and contrast checks. It can exit with failure while leaving a file that looks like a completed remediation, or replacing an existing output with an invalid result.

## Starting points / evidence

`bin/legible.js:121-151` writes near line 127, then validates. The summary path at 107-117 already follows a safer refuse-partial-output approach.

## Implementation scope

Build and validate the candidate before publishing it. Write to a temporary sibling and atomically replace the destination only after all required assertions pass. If draft output is useful, make it an explicit option with unmistakable status. Clean up temporary files on failure and preserve any prior destination.

## Acceptance criteria

- [ ] A preservation or contrast failure returns nonzero and leaves the prior destination byte-for-byte unchanged.
- [ ] No final output appears when a first-time remediation fails.
- [ ] A passing remediation publishes the expected file atomically.
- [ ] Write/rename errors are surfaced and temporary artifacts are cleaned up safely.
- [ ] Tests check output contents/existence as well as exit status.

Keep the change focused on this issue. Use synthetic fixtures for sensitive data and mocked providers for automated tests; do not require paid model calls to run the regression suite.

Start in bin/legible.js:121-151 and compare the fix command with the safer summary path at 107-117. Use synthetic sensitive-data fixtures and mocked providers to test failed and passing remediation cases, including destination contents, existence, exit status, write/rename errors, and temporary-file cleanup. Done means failed validation preserves the prior destination or creates no output, while passing remediation publishes the expected file.

Written by the indexing model from the issue text.