Safety: use temporary copy of Portage marker for Stage 4 manual 2-way merge tools

[rich0]

Problem

Stage 3 (#65 / PR #67) passes disposable /tmp views of the ancestor and Portage marker into interactive 3-way tools so accidental saves on non-live panes cannot corrupt permanent backups or ._cfg* files.

Stage 4 (manual 2-way merge) still launches tools on the real marker:

meld $path_live $path_new
# kdiff3 / sdiff / imediff / etc. similarly pass real $path_new

For tools where the right pane is fully editable (especially meld), an accidental save on the new-file side can:

• Corrupt the ._cfg0000_* marker if the user later cancels
• Install bad content if they choose replace (cp $path_new $path_live)

The live file must stay real (intentional save target for meld left pane / vimdiff).

Proposed solution

Reuse the one-file merge-view temp helpers from #67:

my $view_new = make_merge_view_temp($path_new, "new", $cfg_basename);
# rebind $path_new for launch_tool only, then restore + cleanup

Only Stage 4 needs this; Stages 1–2 do not launch interactive tools with editable non-live panes. Stage 5 is prompt-driven special cases.

Acceptance criteria

• Stage 4 interactive merge tools receive a /tmp (or $TMPDIR) copy of $path_new, not the real marker
• Real marker intact if the tool overwrites its input and the user cancels
• Successful replace/merge/keep still operate on real paths after tool exit
• Live file is never temp-copied
• File-focused tests (hostile mock + path asserts), similar to Stage 3 Tier D coverage
• tool_intro for 2-way tools notes the new pane is a temporary view when applicable

Related

• Safety improvement: Use temporary copies for non-live files in 3-way merge (e.g. Meld middle/right panes) #65 — Stage 3 view temps (ancestor + marker)
• Validate ._cfg* markers against Portage CONTENTS hashes before promoting to backup ancestors #66 — CONTENTS hash validation before promoting markers to backup ancestors (separate failure mode)
• PR feature: Stage 3 merge tools use /tmp views of ancestor and marker (issue #65) #67 — implements Stage 3 helpers (make_merge_view_temp / cleanup_merge_view_temp)

Non-goals

• Changing Stage 2 diff3 (non-interactive)
• Temp-copying $path_live or $path_merged
• Merging with the backup-promotion temps ($path_temp_*)

[rich0]

Note: PR #67 already lands the reusable one-file helpers:

• make_merge_view_temp($src, $role, $basename) → view path or ""
• cleanup_merge_view_temp($view)
• cleanup_merge_view_temps(@views) for 0–N

Stage 3 uses two calls (ancestor + new). Stage 4 should only need one for $path_new.