Fix atomic write, symlink-loop abort, and concurrency=0 hang in adr-bot

[judyks]

Problem

Four latent bugs in adr-bot, none of which surface in normal use:

• Data loss. write_files used fs::write, which truncates before writing. merge_content carries through prose written outside the managed markers, so a crash mid-write (SIGKILL, disk full) left CLAUDE.md truncated — and that content is unrecoverable, since the tool never authored it and cannot regenerate it.
• Stack-overflow abort. signals::pipeline::walk_dir recursed on path.is_dir(), which follows symlinks, with no depth cap or visited set. A symlink cycle in the repo recursed until the process aborted.
• Ten-minute hang. ConcurrentTailoringConfig::new rejected batch_size == 0 but not concurrency. A hand-edited concurrency: 0 reached Semaphore::new(0), hanging every project for the full per-project timeout (600s default) before reporting a misleading RunnerTimeout.
• CI flake. Two .spawn() calls in auth.rs were not wrapped in spawn_with_etxtbsy_retry, unlike the five other spawn sites. Test fixtures write a script and immediately exec it, so a concurrent fork holding a write fd across fork→exec returned ETXTBSY and surfaced the wrong error variant.

Changes

File	Change
generation/writer.rs	Write to a temp file in the same directory, then rename into place. Probe target writability first (see below).
analysis/signals/pipeline.rs	Skip symlinks via entry.file_type(), mirroring the existing guard in rule_resolver.rs.
tailoring/concurrent.rs	Reject concurrency == 0 with ConfigError, matching the existing batch_size guard.
cli/commands/auth.rs	Route both spawns through spawn_with_etxtbsy_retry.

Impact

No change to the normal path. Writes are now crash-safe, a symlinked repo no longer aborts analysis, and an invalid concurrency fails immediately with an actionable message instead of hanging for ten minutes.

For the reviewer

• One deliberate behavior decision. rename(2) requires write permission on the containing directory, not on the target file — so an atomic write would silently replace a CLAUDE.md the user had deliberately made read-only, which the previous fs::write could not do. write_files now probes the target with OpenOptions::write(true).open() (no truncate, so the file is untouched) and refuses. This preserves the prior behavior rather than accepting the rename semantics.
• The auth.rs change is unrelated to the rest of this PR. It fixes a pre-existing flake that was failing CI on this branch, not a regression introduced here. Straightforward to split out if preferred.
• Permission-based tests cannot be verified as root, which bypasses DAC permission checks. Verified under setpriv --reuid=65534: 3014 passed, 1 failed — that one failure being git's "dubious ownership" error from running as a non-owner of the checkout, not a code issue.

Test plan

• cargo test --lib, cargo clippy --lib --all-features, cargo fmt --check — all green in CI
• New/updated tests: test_write_to_readonly_file_returns_failed, test_write_fails_when_temp_file_cannot_be_created, collect_source_files_skips_symlink_cycle, walk_dir_skips_entries_that_are_neither_dir_nor_file, test_config_new_zero_concurrency_returns_config_error