[codex] Write single proofs atomically

[ryan-wong-coder]

Summary

• Write .sproof single-proof files through a sibling temporary file and rename into place.
• Preserve private 0600 permissions and clean temporary files on failure.
• Explicitly reject directory targets so atomic rename cannot replace an existing directory on platforms that allow that edge case.

Root cause

The core single-proof writer used os.WriteFile directly, unlike the CLI and desktop export paths. An interrupted export could leave a partial proof file, and the first atomic-write draft exposed a platform-specific directory replacement edge case that now has regression coverage.

Validation

• go test ./internal/sproof ./sdk ./cmd/trustdb
• go test ./...
• go vet ./...