fix: deep-scan findings + pre-merge review gate

[deveshctl]

Summary

Addresses 5 defects from the prior deep scan, plus 5 additional CONFIRMED issues surfaced by the pre-merge code-review gate (per CLAUDE.md PR review discipline rule #1).

Original deep-scan findings (all 5 fixed)

• Multi-GB layer OOM — file extraction (x save, content viewer) replaced eager loadLayerTars (full map of blobs in memory) with a lazy blobLoader closure. Peak heap is now bounded by one layer blob plus an explicit per-blob size cap (16 GiB) — malformed archives declaring petabyte layers can no longer trigger runaway allocation. (image/extractor.go, image/archive.go)
• Non-atomic save — x save previously used os.WriteFile, leaving truncated files on process kill / OOM / power loss. Now writes via temp-file + rename in the target's directory; the file at the chosen path always holds either the complete pre-write content or the complete new content.
• TUI freeze on syntax highlighting — Chroma tokenisation moved off the bubbletea input goroutine via a tea.Cmd. The plain-text view appears immediately; the coloured version swaps in when ready, gated by requestID so stale highlights from interrupted opens are discarded.
• CJK/emoji column overflow in Waste panel — truncateLeft now measures display columns via lipgloss.Width rather than rune count.
• Layer blob size cap — explicit MaxLayerBlobSize (16 GiB) ceiling on each layer body read, preventing runaway allocation from a hostile or malformed manifest.

Pre-merge review gate findings (3 CONFIRMED + 2 PLAUSIBLE-promoted, all fixed)

The code-review skill (5 finder angles + 1-vote verifier + sweep) was run on the working-tree diff before commit. Five blocking findings:

• atomicWriteFile bypassed umask — tmp.Chmod(perm) applied literal mode bits. New build-tagged applyUmask helper round-trips through syscall.Umask on POSIX and is a no-op on Windows, restoring os.WriteFile semantics.
• atomicWriteFile destroyed symlinks — os.Rename replaced the link with a regular file. Now filepath.EvalSymlinks resolves first and the rename targets the resolved path, so saving over a symlink updates the link's target rather than the link itself.
• EvalSymlinks fallback masked all errors — narrowed to os.IsNotExist only. Permission-denied / loop-detection errors now surface to the caller rather than silently writing at the unresolved path.
• No parent-dir fsync — CHANGELOG and docstring promised power-loss safety; without fsync(parentDir) after rename, ext4 default mount options can lose the rename. Added build-tagged syncDir (POSIX Sync on the directory fd, Windows no-op since NTFS journals MFT updates).
• Test fd leak — TestReadSingleBlobFromSpool_OversizedHeaderRejected never closed its temp *os.File; on Windows this blocked t.TempDir cleanup. Added defer tmp.Close().

Triage of remaining PLAUSIBLE findings (accepted with rationale)

• syscall.Umask is process-global; concurrent file creation in this codebase only opens 0o600 files, which are unaffected by the round-trip.
• Symlink TOCTOU window is inherited from any atomic-rename tool — pre-fix os.WriteFile's O_TRUNC follow had the same class of risk.
• io.ReadAll cap allows a 16 GiB allocation by design (per MaxLayerBlobSize doc: "permissive enough for production ML images").
• Ownership/ACL not preserved across rewrite — inherent to atomic-replace.
• scanBlobIndex duplicate-name overwrite — adversarial-only, malformed archive corner.

REFUTED: claimed O(N²) re-scan in walkBackForFile — tar.Reader.Next() uses Seek when the underlying reader is io.Seeker (*os.File qualifies), so per-call header scans are header-only seeks, not body re-reads.

Test plan

• go build ./... clean (Windows dev machine)
• go vet ./... clean
• gopls check clean across touched files
• Cross-builds clean: GOOS=linux, GOOS=darwin, GOOS=windows
• CI: go test ./... passes on Linux runner
• Gate C: x save against nginx:latest; verify file contents match
• Gate C: x save over a symlink; verify the symlink target is updated, link preserved
• Gate C: open a large Go file in the viewer; verify plain text appears immediately, highlights swap in
• Gate C: open the Waste panel on an image with CJK paths; verify column alignment