Load/save robustness: OOM-safe load, guarded open loop, save fallbacks

- OpenFromFile builds the new content in a separate PieceTable and
  swaps it in only when complete. A reload that ran out of memory used
  to leave the buffer empty (filename, journal and dirty state intact),
  and the next save truncated the file.
- Editor::ProcessPendingOpens catches exceptions from opening (it runs
  in every frontend's loop, outside command dispatch, so bad_alloc on a
  huge file ended the editor); the terminal draw is guarded too.
- The hard-link save copy uses a unique mkstemp name, so a leftover
  copy no longer blocks every later save; if no copy can be created the
  file is still written in place.
- When no temp file can be created in the directory (file writable,
  directory not), an existing regular file is written in place instead
  of the save failing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rcVQiiWyTzoNrsvLSaAfB

TerminalFrontend.cc

@@ -135,7 +135,11 @@ TerminalFrontend::Step(Editor &ed, bool &running)
 	// busy on large or long-line files while idle.
 	const auto now = std::chrono::steady_clock::now();
 	if (changed || now - last_draw_ >= std::chrono::milliseconds(1000)) {
-		renderer_.Draw(ed);
+		try {
+			renderer_.Draw(ed);
+		} catch (const std::exception &e) {
+			ed.SetStatus(std::string("Display error: ") + e.what());
+		}
 		last_draw_   = now;
 		first_frame_ = false;
 	}