Tracking S4b: wire guarded writes into the diff-view save paths

[easonLiangWorldedtech]

Tracking issue for the S4b PR (branch feat/guarded-write-wiring-s4b; PR to be opened after review).

Part of the file-write safety series — plan: easonLiangWorldedtech/Zoo-Code#33, epic: #1375. Item: S4b — Wire guarded writes into the diff-view save paths. Stacks on the S4a PR (guarded CAS core), which itself stacks on S1+S2+S3 (#1383, #1394, #1395).

Scope

• Route DiffViewProvider.saveDirectly (the plain-file-diff save path) and DiffViewProvider.saveChanges (the legacy diff-editor save path) through the S4a guardedWrite CAS instead of writing the file directly.
• Sentinel errors (stale / not-read-yet) propagate up into the tool catches so the model receives the exact remediation text and can re-read + retry.
• ApplyPatch delete path stays unguarded (deletes do not CAS).
• userEdits semantics in saveChanges preserved.

Acceptance

• Behavioral contract tests: unobserved+existing write fails with the not-read-yet remediation; create succeeds; observed write succeeds; stale version fails; a deleted file then written fails as stale
• Tool-level assertions that the remediation text reaches the tool result the model sees
• No behavior change for clean saves (no new latency, no new say types)
• CI green (ubuntu unit-test gate), 100% codecov patch coverage

Status

• PR: to be opened (after S4a review/ship)