fix(xodr): never dereference a stale road link when writing (#311)

[JArmandoAnaya]

Fixes the pre-existing write_xodr segfault filed as #311 — a P4 blocker: it gates p4-s4 (#319), whose junction membership editing multiplies the code paths that can leave a stale reference behind.

Root cause

core/src/xodr/writer.cpp dereferenced network.road(*road_target)->odr_id in write_link_element with no null check.

RoadNetwork::erase_road deliberately drops only the junction connections that name the erased road (core/src/road/network.cpp:110-115) — the surviving connecting roads keep a predecessor/successor holding the now-stale RoadId. That is exactly the state #311 reproduces by erasing a junction arm. Confirmed under lldb: EXC_BAD_ACCESS at +0x18, inside std::string.

erase_junction leaves the symmetric hole on the JunctionId arm of the same variant.

Two things worth recording, both of which the issue anticipated:

• It is not the junction surface/boundary path. Those were already guarded — arm_face, link_arm and arm_face_vertices all null-check. The crash was plain road-link serialization, merely reached via the dangling arm.
• The editor cannot produce this state. edit::delete_road's closure strips connections and arms and deletes orphaned connecting roads. So this is the defence-in-depth guard the issue asked for — and it also covers a hand-edited or foreign .xodr, which reaches the writer with no closure at all.

Fix

• link_target_odr_id resolves a RoadLink to its @elementId or nullptr, covering both arms of the target variant and never dereferencing.
• write_road resolves both ends before opening <link>, so a stale link is dropped and a road whose links are all stale emits no empty <link/>.
• validate_network warns per omitted link, citing asam.net:xodr:1.4.0:ids.only_ref_defined_ids, so the drop is never silent — mirroring the existing rm:arms rule that stale references are not serialized.

Tests

Five new tests in core/tests/test_junction_export.cpp:

Test	Covers
WriteXodrSurvivesAnErasedArmRoad	the #311 repro — crashed before, passes now
StaleRoadLinksAreOmittedNotWritten	erased road is unreferenced; no empty <link>
ValidateNetworkWarnsAboutTheOmittedLink	the warning and its rule id
WriteWithADanglingArmIsDeterministic	determinism holds in the degraded state
StaleJunctionLinksAreOmittedToo	the erase_junction variant

Verification

• roadmaker_core_tests — 670/670 pass.
• CI-preset build (-Werror) clean; no new warnings.
• Whole-tree clang-format --dry-run --Werror (CI's exact command) clean.

No public kernel API change, so no bindings or example update is required.

Closes #311