AI subsystem: review fixes

[andriiryzhkov]

I ran a multi-pass AI-assisted review over the new AI subsystem code – headers, core implementation, domain logic, UI layer, Lua bindings, and a few adjacent non-AI files. I traced every claim line-by-line against the actual code before touching anything, and roughly one in five survived that check. The rest is in this PR.

Everything here is small and preventive. No new features, no behaviour rewrites, no refactors beyond the minimum needed for a specific bug. Each finding is its own commit so anything can be cherry-picked or reverted on its own.

What's in here

• NULL-deref guards where I was dereferencing helper return values without checking – the safe pattern already existed elsewhere in the same files, the new code just hadn't picked it up.
• Cleanup on error paths: mipmap cache release, stale raw-preview crops on image switch, partial DNG/TIFF files unlinked when the write fails partway.
• Atomic disk writes via temp + rename (.dtmodel install, segmentation disk cache). A crash mid-write no longer leaves a half-written file that confuses the next run.
• Surfacing return codes that were getting silently swallowed – dt_ai_run, TIFFWriteScanline, decoder warmup.
• Bounds and sanity checks for caller-controlled inputs: densecrf sigmas, decoder shape updates that would otherwise read past the mask buffer.
• Runtime preflights so ORT can't abort() the process during execution-provider init on a broken CUDA or ROCm stack.
• API cleanup: dt_ai_registry_t is now opaque to external callers, the unused ep_flags parameter is gone, dt_ai_snapshot_conf_state is idempotent.
• Documentation: threading contracts and pointer-lifetime contracts where they weren't written down.

Risk

Low. Most fixes are one-line guards or unlink-on-failure additions. The largest single change is the opaque-registry refactor (f4bd660574) – a mechanical rename that keeps the same semantics under the same lock as before.

[TurboGit]

Some style comments, and a better way to create a temp file.

[andriiryzhkov]

@TurboGit : Fixed according to the comments

[TurboGit]

Thanks!