v0.3.5 — stable intermediate filename, 3.1x faster large renders

• Render performance: the intermediate .typ file now uses a stable per-(process, thread) filename instead of a fresh random name per render. Typst's incremental compilation cache is keyed by path, so the random name was defeating it entirely — measured 3.1x faster on a 1,000-row invoice for repeated renders (the isolated random-name penalty is up to ~3.7x) (180.8ms -> 59.1ms median) and 2.4x faster with content varying every render (174.2ms -> 72.4ms), Apple M5 Pro. Discovered via the pdf-engine-benchmarks repo.
• Compile errors now preserve the intermediate file under a unique _trustrender_err_*.typ name (previously the random working name), so a later render in the same thread can never overwrite the evidence; TrustRenderError.source_path points at the preserved file.
• The stable name still means a fresh private inode per render: the path is unlinked and recreated with O_CREAT | O_EXCL (mode 0600, O_NOFOLLOW where available), so pre-positioned symlinks/FIFOs/files are removed as entries, never followed or reused — matching mkstemp's safety properties; a per-process random token (re-derived after fork()) prevents collisions between PID-namespaced replicas sharing a template volume, and any residual collision fails loudly on the exclusive create
• 8 new tests pin the discipline: stable within a thread, distinct across threads, unique preservation on error, no leftovers on success, symlink never written through, pre-positioned files replaced with a fresh inode (1011 total).