fix(watcher): never overwrite a parked note; a proposal cannot be forged or pre-empted; CRLF notes; wing dirs must be plain (#205)

From the independent review of #207:
- parked notes are created O_EXCL with -2,-3 suffixes (same-named notes from
  different subfolders were overwritten and their originals deleted)
- proposed_wing is emitted only if a plain wing name; a note's own proposal_*
  keys are dropped so they cannot outrank the resolver's (first-wins reads)
- CRLF notes: wing: key honoured, one valid frontmatter block on parking
- KnownWings skips wiki dirs that are not canonical lower-case names
- adds the wingmigrate dry-run/apply command
Each fix has a test that failed first and a mutant that fails it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ingestion/internal/wing/known.go

@@ -5,6 +5,8 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 )
 
 // legacyDirs are the retired wiki/{concepts,entities,sources}/ layout, not wings.
@@ -20,7 +22,7 @@ func KnownWings(brainDir string) ([]string, error) {
 	}
 	var out []string
 	for _, e := range entries {
-		if !e.IsDir() || legacyDirs[e.Name()] {
+		if !e.IsDir() || legacyDirs[e.Name()] || !plainWingName(e.Name()) {
 			continue
 		}
 		subs, err := os.ReadDir(filepath.Join(brainDir, "wiki", e.Name()))
@@ -37,3 +39,8 @@ func KnownWings(brainDir string) ([]string, error) {
 	sort.Strings(out)
 	return out, nil
 }
+
+// plainWingName reports whether name is already in the canonical lower-case form
+// the pipeline writes. Anything else would make the pipeline create a different
+// wing than the one matched.
+func plainWingName(name string) bool { return brain.Sanitise(name) == name }

ingestion/internal/wing/known_test.go

@@ -27,3 +27,16 @@ func TestKnownWings_NoWikiDirIsAnError(t *testing.T) {
 	_, err := wing.KnownWings(t.TempDir())
 	assert.Error(t, err, "a brain without wiki/ must not look like a brain with no wings")
 }
+
+// Known matches case-insensitively and the pipeline writes the lower-case name,
+// so a wiki directory that is not already plain lower-case would make the
+// pipeline create a different, new wing. It is not a candidate.
+func TestKnownWings_SkipsADirectoryThatIsNotAPlainWingName(t *testing.T) {
+	dir := t.TempDir()
+	writePage(t, dir, "wiki/Radar/facts/a.md", "x")
+	writePage(t, dir, "wiki/has space/facts/a.md", "x")
+	writePage(t, dir, "wiki/ok/facts/a.md", "x")
+	got, err := wing.KnownWings(dir)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"ok"}, got)
+}