Load/save robustness: OOM-safe load, guarded open loop, save fallbacks

- OpenFromFile builds the new content in a separate PieceTable and
  swaps it in only when complete. A reload that ran out of memory used
  to leave the buffer empty (filename, journal and dirty state intact),
  and the next save truncated the file.
- Editor::ProcessPendingOpens catches exceptions from opening (it runs
  in every frontend's loop, outside command dispatch, so bad_alloc on a
  huge file ended the editor); the terminal draw is guarded too.
- The hard-link save copy uses a unique mkstemp name, so a leftover
  copy no longer blocks every later save; if no copy can be created the
  file is still written in place.
- When no temp file can be created in the directory (file writable,
  directory not), an existing regular file is written in place instead
  of the save failing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rcVQiiWyTzoNrsvLSaAfB

Editor.cc

@@ -5,6 +5,7 @@
 #include <utility>
 
 #include "Editor.h"
+#include "ErrorHandler.h"
 #include "syntax/HighlighterRegistry.h"
 #include "syntax/CppHighlighter.h"
 #include "syntax/NullHighlighter.h"
@@ -487,6 +488,24 @@ Editor::ResolveRecoveryPrompt(const bool yes)
 
 bool
 Editor::ProcessPendingOpens()
+{
+	// Opening can throw (bad_alloc on a huge file, filesystem errors). This
+	// runs from every frontend's loop, outside command dispatch: report the
+	// failure instead of letting it end the editor.
+	try {
+		return process_pending_opens_();
+	} catch (const std::exception &e) {
+		kte::ErrorHandler::Instance().Error("Editor", std::string("open failed: ") + e.what(), "");
+		SetStatus(std::string("Open failed: ") + e.what());
+	} catch (...) {
+		SetStatus("Open failed");
+	}
+	return false;
+}
+
+
+bool
+Editor::process_pending_opens_()
 {
 	if (PromptActive())
 		return false;