Guard data-loss paths: quit, reload, close, recovery answers, save-as

- Quit checks every buffer for unsaved changes and names them; it used
  to look only at the current buffer and exit, dropping the rest (an
  unnamed buffer's text was unrecoverable). Save-and-quit does not quit
  while other buffers are dirty.
- Reload of a dirty buffer needs a second C-k l with no edit in between
  (it discarded edits, undo history and the journal at once), and a file
  deleted on disk is not 'reloaded' into an empty buffer.
- At the destructive y/n prompts ("Recover swap edits?" and "Save
  changes to X?"), only an explicit 'n' discards; Enter or any other key
  cancels. Keys typed while the startup recovery prompt appeared used to
  delete the crash journal. SwapRecoveryPrompt_Discard now answers 'n'.
- Saving from the close prompt refuses to overwrite a file changed on
  disk, like save.
- Save-as onto a file open in another buffer is refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rcVQiiWyTzoNrsvLSaAfB

Editor.cc

@@ -555,7 +555,7 @@ Editor::ProcessPendingOpens()
 						pending_recovery_open_      = req;
 						pending_recovery_swap_path_ = swp;
 						StartPrompt(PromptKind::Confirm, "Recover", "");
-						SetStatus("Recover swap edits for " + req.path + "? (y/N, C-g cancel)");
+						SetStatus("Recover swap edits for " + req.path + "? (y/n, C-g cancel)");
 						return opened_any;
 					}
 				} else {