[thebrandonlucas]

--output-file on a path that already exists now says so, instead of showing a raw OS error:

Case	Before	After
Path exists	Cannot reserve output out.json: File exists (os error 17), no hint	out.json already exists; --output-file writes only to a new file. Hint: Pass a path that does not exist yet, or move the existing file. No change was sent.
Any other refusal (missing directory, no permission)	the OS error, no hint	the same message. Hint: Pass a path in a directory you can write to. No change was sent.

The file is reserved before any request, so "No change was sent" holds for every command. Refusing to overwrite is unchanged. The fix is in Output::new, so the journal and other private files keep new_private's message.

In the CLI benchmark, an agent hit the raw error and had to work out why. Closes #83.

Stack: 2 of 6, on #87. It doesn't depend on #87's change.

• User-visible change: a CHANGELOG.md (Unreleased) line is added. No guide describes this error.
• The verification gate passes: fmt, clippy, machete, cargo test (253 tests) and check-coverage.py.
• Reviewed against feat(cli): accept -o as short for --output #87. A new integration test covers both refusals: the path exists, and the directory is missing. It checks the message, the hint and exit code 2, that the existing file is untouched, and that the mock API received no request.
• CRAP on 78c8a98: 0 functions at or above 20. The highest is wait_for_payment at 19.60, and reserve_output_file is 2.0.
• Checks not run: none.

[tee8z]

Approved 78c8a98 against feat/cli-output-short-o (#87 79b7856).

"No change was sent" holds for every command. In startup::execute, output(...) reserves the file before api::execute, before each local command, and before a price query. The only requests before it are reads: the picker, the wallet shortlist and the wallet-currency read. The existing-path check uses symlink_metadata, so a dangling symlink is reported as existing, which is correct because create_new refuses it. Other uses of new_private, such as the journal, keep their message. The test covers both refusals, checks that the existing file is untouched, and checks that the mock API received no request.

Validation on this head, in nix develop: cargo fmt --check, cargo clippy --locked --all-targets -- -D warnings, cargo machete --with-metadata, cargo test --locked (132 unit, 121 integration) and python3 scripts/check-coverage.py passed. CRAP: 609 measured functions, none at or above 20, highest wait_for_payment at 19.60; 175 functions were unmeasured. CI is green.