Fuzz the edges: 24 bugs found and fixed, including a flatten that could certify a file it had overwritten

[owenpkent]

Stacked on #3 (retry-resume), so the diff here is only the four commits
below. Retarget to main once #3 merges.

What this changes

Two new property-test modules, then fixes for the 24 bugs they found.

tests/test_fuzz.py already fuzzed what a filename can contain. These go
after two layers it never reached:

• tests/test_fuzz_edges.py — what a card can contain. A BRAW clip whose
  atom headers lie, a tree that maps two sources onto one destination, a
  directory junction pointing at its own parent, a retry policy someone
  hand-edited into a preset.
• tests/test_edge_cases.py — the layers between the bytes and the
  paperwork. What ffprobe hands back, what a number formats to, what a digest
  compares equal to, what a name renders to.

Each bug was committed first as a xfail(strict=True) naming the offending
line, then fixed. Both suites now run clean, so every test that was pinning a
reproduction is pinning a regression.

Two of these were worth the whole exercise.

Flattening could destroy a file and certify it. With --flat (or the app's
"Recreate the source folder structure" unticked), every source mapped to
destination/name and nothing checked two sources for one target. Two clips of
the same name in different card folders left one file on disk and both rows
reading Verified — each was verified as it landed, before the next
overwrote it, so full verification passed them too. That is the worst shape a
bug can take here: the report attests to a file that is no longer there.

source: 2 files / 3000B      dest: 1 file / 2000B
non-VERIFIED: none           job.errors: none

The collision is now caught against the scan, before a byte moves, and the job
refuses naming both paths.

One malformed clip aborted the whole offload. engine.run called probe()
unguarded and probe() did not guard its own parsers. The realistic trigger
turned out not to be a crafted file at all: it is ffprobe writing "N/A" in a
numeric field, which it does routinely for streams it cannot fully describe.
The clips after the bad one were never copied and no report was written.

The remaining 22, grouped by what they had in common:

Family	Fix
Trusting a length that came out of the file	_read_timing, the ilst loop, _descend's recursion and _find_moov's read are all bounded by what is actually present
Text that cannot survive the trip	The XML 1.0 filter reports/mhl.py always had now lives in util and covers the CSV and ASC MHL writers
Comparing unlike with unlike	Digests compare per algorithm: case-folded for hex, exact for C4
Trusting a file we wrote	A damaged history.json no longer raises out of History()
Arithmetic that ignored its own edges	format_size, _parse_rate, naming.build

What you verified

• The collision fix refuses before writing, not after. The check runs on the
  scan output; the destination directory does not exist when it raises.
  Confirmed end to end, not just in the unit test.
• The collision fix does not cost the ordinary case. A separate test
  flattens two differently-named files and asserts both land.
• --flat was reachable three ways before this mattered: the CLI flag,
  Simple mode's checkbox, and the preset editor's. All three go through
  engine.run, so the guard covers them.
• The malformed-clip fix does not weaken a verdict. Metadata is read after
  the bytes are copied and verified, so containing it cannot make Verified
  easier to reach. The file still copies, still verifies, and the job carries a
  warning.
• Every fix has a test that fails against the old code. That is how they
  were written: the reproduction was committed as a strict xfail first
  (64c37f0, ed6cdc0), and 821b39b turns all 49 green.
• The BRAW fuzzer finds the crash independently. The random-atom-tree sweep
  passes and is kept as a control, because a random tree almost never grows the
  vide handler _read_timing requires. A second sweep pins that shape and
  fuzzes only the two bodies read at fixed offsets; it rediscovers the crash and
  minimises it to two variants.
• Two reported findings were not bugs, checked rather than assumed:
  argparse's choices= rejects an unknown --verify/--profile before the
  enum constructor runs, so there is no traceback. Both are kept as passing
  controls.
• Soak at 3000 examples per property finds nothing beyond what is pinned
  (482 pass, ~3 min).

Behaviour changes worth a second opinion

Three judgement calls, flagged because they are reversible and you may want
them reversed:

1. --flat refuses rather than auto-renaming. Renaming preserves the
   intent but silently changes filenames an NLE may be relinking against.
   Refusing matches the existing assert_safe_destinations pre-flight. Cost:
   --flat now fails on cards it used to "work" on.
2. RetryPolicy clamps instead of raising. presets.json is hand-editable
   and a nonsensical delay should not raise mid-transfer.
3. History fingerprints are seeded with the source name, so entries recorded
   before this change will not match. Duplicate-card detection degrades to not
   warning, which is the safe direction, and re-records correctly on the next
   offload. Chosen over special-casing empty sources because the same collision
   class exists for non-empty ones.

Docs

docs/data-safety.md carries the weight: five new rows in the guarded table, a
section on why flattening is refused, and one honest addition to what is still
not protected — the collision check compares through os.path.normcase, so
copying on Linux or macOS from a case-sensitive source onto a case-insensitive
destination is the one arrangement it does not catch.

Also: docs/braw.md on reading a file that is lying to you, docs/ascmhl.md on
the round-trip bug and per-algorithm comparison, docs/performance.md on
junctions, and corrected test counts in README (it claimed 413 at 82%;
it is 482 at 83%), CONTRIBUTING and the PR template.

CI's soak job only ever ran test_fuzz.py, so the two new modules would not
have been soaked at all. It now runs all three.

Checklist

• pytest passes (482 tests)
• ruff check src tests passes
• Tests added for the behaviour changed

Touches the copy and verification path:

• There is a test that fails against the old code — 49 of them, each
  committed as a strict xfail before the fix
• This does not make a "Verified" verdict easier to reach. It makes one
  harder: a layout that would lose a file is refused, and metadata failures
  no longer pass silently
• docs/data-safety.md still describes reality,
  including its "what is still not protected" list

Changes documented behaviour:

• The relevant docs/*.md is updated
• The test count in README.md is updated