fix(import-audit): preserve JSON reports when writing fails - #4425

What

import_audit.py --json audit.json truncates the destination before writing the new report. A write error leaves an incomplete JSON file and destroys the previous audit. For a new destination it leaves a partial file that looks like an available report.

Write the complete report inside a temporary directory beside the resolved destination, then atomically replace the destination. New reports retain the normal 0666 permissions filtered by the process umask, without changing that process-wide setting. Preserve existing report permissions and symlink targets. Keep the caller-supplied output path in the directory-error diagnostic, including Windows short paths. Failed writes or replacements keep the old report, return the existing failure exit code and remove staging files, including Windows read-only temporaries. Input-overwrite protection and import classification stay unchanged.

Eight new test methods exercise the CLI entry point and real temporary files. POSIX permission cases run with isolated subprocess umasks. The disk-full injection writes an actual partial prefix before raising ENOSPC; with main dacd78525, an existing report is truncated and a new report is left behind. A replacement denial is also covered. This is controlled fault injection, not a claim of exhausting the host disk.

Tested

Rebased onto main dacd78525e537a779682032c0ace7f7af120af05, including #4545 and #4606, at exact head d45fee9b69c8f59e11818d3e25fbdfc0b6e296fd:

• Windows 11, Python 3.12.4: python -m unittest discover -s tools/tests -p 'test_*.py' -q runs 287 tests, 285 pass and the two POSIX-only permission tests skip.
• WinLibs GCC 15.2.0 r7, Ninja, Release: the relinker-only build succeeds and all 150 CTests pass. The focused import_audit CTest also passes.
• Exact-source Windows/Linux/macOS validation passes with Python 3.12. Each runs all 287 tools tests, including JSON stops, module imports, atomic replacement, partial writes, symlinks, permissions and input-overwrite protection. Windows skips the two POSIX-only permission tests; Linux/macOS skip the Windows-only read-only test.
• On all three hosted platforms and local Windows, the partial-write regression fails in both subcases against main's import_audit.py: the old report is truncated, or a partial new report is left behind. Restoring the exact PR source passes. This is controlled fault injection, not actual disk exhaustion.
• The official Build run also passes all three relinker builds and test suites (Windows, Linux, macOS) for this PR head.
• Conventions and git diff --check pass. No native runtime change or title run.

Overlap coordination

#4545 and #4606 are now merged. This rebase preserves main's stops construction and JSON field, then passes the complete result to write_json(args.json, result). It also retains the merged hard-link test changes, with one os import and the stat import required for permission tests. Their module-import, stops and hard-link regressions pass alongside the atomic-write tests. #4415 is closed without merging. No outstanding dependency on those PRs remains.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw; no runtime exports or silent stubs changed
• No notes, investigation files or images added to the repository
• New third-party code is a submodule built from source; none added
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• AI-assisted: yes (Codex)