fix(sidecar): stop silently destroying ratings, tags and EXIF on an unreadable .rrdata

[magnusrodseth]

Found while prototyping #1421, but this stands on its own and needs none of that proposal.

The bug

load_sidecar returns ImageMetadata::default() on any parse failure, and sidecar writes are read-modify-write on top of it:

// file_management.rs, save_metadata_and_update_thumbnail
let mut metadata = crate::exif_processing::load_sidecar(&sidecar_path); // -> defaults
metadata.adjustments = final_adjustments;
std::fs::write(&sidecar_path, serde_json::to_string_pretty(&metadata)?)?;

So a sidecar that fails to parse for any reason (a truncated write, a half-synced file, a hand-edited one) does not merely fail to load. The very next save writes the defaults back over it, and that image's rating, tags and cached EXIF are gone, with nothing logged. set_color_label_for_paths takes the same path.

Reproducing

echo '{ truncated' > IMG_0001.ARW.rrdata   # simulate a bad write
# open the folder in RapidRAW, adjust anything on that image
cat IMG_0001.ARW.rrdata                     # rating and tags are gone

The fix

An unreadable sidecar is copied to <name>.rrdata.bak before anything can overwrite it, with a warning naming both paths. The app still continues with defaults, so one bad file cannot make an image uneditable, and behaviour for every sidecar that parses is unchanged.

Quarantine never destroys data: a backup whose contents differ is never overwritten (the next free slot is used), and an identical backup is a no-op, so the repeated loads done by the thumbnail and metadata workers cannot pile up copies.

Also: unknown top-level keys are no longer dropped

adjustments is an opaque Value and already round-tripped keys it did not recognise. Unknown envelope keys did not survive, so external tooling could not annotate a sidecar without the GUI silently stripping it on the next save. ImageMetadata now carries them through with #[serde(flatten)].

Tests

This adds the repo's first tests (9) plus a cargo test job to run them. They cover both quarantine paths, the no-clobber and no-accumulate properties, the round trip, and that a valid sidecar is never quarantined.

I checked they can actually fail: reverting load_sidecar to the old unwrap_or_default fails exactly the quarantine tests, and removing the flatten fails exactly the round-trip test.

Verified beyond unit tests by driving the real headless export path over a JPEG with a deliberately corrupted sidecar: the .bak SHA256 matches the original, the original is untouched, and the export still succeeds.

cargo fmt, cargo clippy -D warnings and cargo test all pass.

---

Draft because #1421 is still open and you may want a different shape here. Happy to adjust or split further.

Stacked: #1423 builds on this and contains this commit.