fix(recorder): storage-migration same-file guard — never unlink the only copy (#276)

[badbread]

Fixes #276 — P0 footage-loss finding (F1) from the 2026-07-19 adversarial recorder audit. The #70 failure class, resurrected in the "Change storage" migration path.

The bug, reproduced at runtime

When the from/to storage rows resolve to the same file (duplicate rows for one path — storages has UNIQUE(name) but not UNIQUE(path) — or symlinked/bind-mounted roots), copy_with_crc32's same-file bail routed into the copy-failure arm, whose cleanup ran remove_file(dst) — and dst IS src. The defense against truncating the only copy became an outright unlink of the only copy: the policy's oldest MIGRATION_BATCH (256) segments destroyed per attempt, silently, with each retry eating the next 256.

Runtime-proven, not just traced: the new regression test run against the pre-fix code fails with the files destroyed; with the fix it passes.

The fix

• Pre-guard: same_file(src, dst) before the copy → flip the DB row in place with zero file I/O (mirrors move_segment_to_archive's in-place flip). A same-path migration is now the safe consolidation it looks like — rows repoint, files untouched, progress recorded (no false "stalled").
• Cleanup: an in-place segment deletes nothing in either arm (flipped or lost-the-race — the "source" and "destination" are one inode).
• Defense in depth: the copy-failure arm re-verifies !same_file before removing the partial dst, enforcing the audit's phase invariant — the unguarded copy phase never deletes a file it did not itself create — even across a rename/symlink swap between guard and copy.

Verification

• New test change_storage_drain_same_path_flips_in_place (duplicate storage row on one dir → drain → files exist, rows flipped, progress = 2, idempotent re-run). Fails on pre-fix code, passes on fix.
• Existing change_storage_drain_relocates_footage (the normal path) still green.
• Full gate: fmt ✅ clippy -D warnings ✅ cargo test --workspace ✅ (259 recorder tests).

Operator note

Until this is deployed, do not run a policy change-storage migration on any install that might carry duplicate storage rows for one directory.