Load/save robustness: OOM-safe load, guarded open loop, save fallbacks

- OpenFromFile builds the new content in a separate PieceTable and
  swaps it in only when complete. A reload that ran out of memory used
  to leave the buffer empty (filename, journal and dirty state intact),
  and the next save truncated the file.
- Editor::ProcessPendingOpens catches exceptions from opening (it runs
  in every frontend's loop, outside command dispatch, so bad_alloc on a
  huge file ended the editor); the terminal draw is guarded too.
- The hard-link save copy uses a unique mkstemp name, so a leftover
  copy no longer blocks every later save; if no copy can be created the
  file is still written in place.
- When no temp file can be created in the directory (file writable,
  directory not), an existing regular file is written in place instead
  of the save failing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rcVQiiWyTzoNrsvLSaAfB

Editor.h

@@ -568,6 +568,11 @@ public:
 	// Returns true if a file was opened during this call.
 	bool ProcessPendingOpens();
 
+private:
+	bool process_pending_opens_();
+
+public:
+
 	[[nodiscard]] bool HasPendingOpens() const;
 
 	// Swap recovery confirmation state. When non-None, a `PromptKind::Confirm`