Make default Markdown publication atomic and root-contained

Start with the default-layout write path in inc/class-wp-markdown-storage.php around lines 276-308, then read the legacy profile definition in inc/class-wp-markdown-content-layout-profiles.php. Run the existing default-layout and parent-promotion tests before changing the publication flow. Done means staged atomic replacement, root and symlink protection, preserved receipts and cleanup, and deterministic coverage for failed or interrupted publication.

Problem

The default post-type-hierarchy layout is the canonical production layout, but WP_Markdown_Storage::write_post() publishes with an in-place file_put_contents(..., LOCK_EX). A terminated or failed write can leave the authoritative Markdown file truncated or partial.

This legacy path also creates and traverses directories without applying the symlink-segment and root-containment checks used by custom layout profiles. A linked segment inside the canonical tree can redirect publication outside MARKDOWN_DB_CONTENT_DIR.

Relevant implementation: inc/class-wp-markdown-storage.php, default-layout write path around lines 276-308. The default profile is marked legacy in inc/class-wp-markdown-content-layout-profiles.php.

This is a concrete storage-integrity prerequisite for the pure-PHP canonical engine tracked in #232 and may also close one class of durability failure represented by #99.

Required outcome

• Publish default-layout Markdown through a same-directory staged file and atomic replacement.
• Preserve the previous complete canonical file whenever staging or publication fails.
• Validate every destination path segment beneath the canonical root and reject symlinks or directory replacement.
• Retain current hierarchy promotion, stale-path cleanup, indexing, and mutation receipts.
• Add deterministic coverage for failed publication, interrupted-write safety, and linked path segments.

Acceptance criteria

• Readers observe either the previous complete file or the next complete file, never a partial write.
• A failed replacement leaves the prior canonical post readable and unchanged.
• No default-layout write can escape the configured content root through a symlinked segment.
• Existing default-layout and parent-promotion tests continue to pass.

AI assistance

GPT-5.6 Sol via OpenCode reviewed the storage implementation, identified the publication and containment gaps, and helped structure this issue and its acceptance criteria. Chris Huber directed the review and issue creation.