fix(files): stop writes when reading existing content fails

[jonathanKingston]

write_file and approval-time writes currently treat every read failure as an empty/missing file. If an existing local file cannot be read, its contents can be overwritten without the stale-content guard checking them.

Only a missing-file error may take the new-file path. Other errors stop the tool or return an apply error before writing. Regression tests inject EACCES and EIO and verify the existing bytes survive; existing new-file tests cover the permitted path.

Validation: pnpm run check. Both read-failure regressions fail on current main. File I/O handling only; approval policy, hooks, DOM, and layout are unchanged.

[github-actions]

🖥️ PR preview

• Marketing site
• Browser demo
  Interactive, with a mocked backend — jump to a scenario:
• Builds a cupcake site
• Agent-proposed edits open the Changes panel
• Markdown list indentation
• Responsive composer footer
• Subagent display visual reference
• Subagent stays ungrouped beside reading tools
• Semantic search subagent markdown
• Light-theme approval with a bright accent
• Light-theme syntax, fills, and selection
• Grouped outside-sandbox command approval
• Remote desktop discovered-port list with one selected
• Settings scroll + sticky footer geometry
• Per-model reasoning / temperature / top-p
• Thread switch hydration notice
• Thread switch hydration failure
• Chat layout styling
  _{Static demo of the renderer against a mock API — the browser pane, terminal, and all main-process IPC are stubbed, so it never proves main-process behaviour. Rebuilt whenever a push changes the demo bundle; these links go live once the queued deploy lands, shortly after this comment. Removed when the PR closes.}

[copse-release-bot]

Reference screenshots ready for review

Review GitHub’s image diffs in screenshot PR #2586.
Merge it (or enable auto-merge) to apply the accepted PNGs to codex/preserve-files-on-read-error.

Rendered for 3122762e488a by CI run 34250393001; the immutable artifact is reference-screenshot-candidates-34250393001.

If this source branch moves, a later successful render closes the stale review PR and replaces this link.