Harden Forge incident storage diagnostics and concurrency

[im-sham]

Summary

• return structured scan diagnostics and surface corruption counts across CLI and MCP paths
• add strict validation plus read-only repair and quarantine previews
• harden generated incident IDs and atomic writes under process races
• add descriptor-relative atomic no-replace quarantine moves with fail-closed platform handling
• preserve primary edit errors while reporting recoverable partial state separately
• document and test safe recovery, sanitization, and collision behavior

Verification

• python -W error -m pytest — 362 passed
• python -m ruff check . — passed
• python -m compileall forge_cli tests — passed
• git diff --check — passed
• two independent Sol-high review gates; final result zero P0-P3
• live read-only acceptance: 64 valid, 0 corrupt, 0 operational errors
• live corpus count/hash unchanged: 64 files, ca824d6a613a43749bb4081b2353b3aa949813bad4704f44af1493c75a1e43c1

No live quarantine apply or repair mutation was run.