Atomic file writes support a 'beforePublish' refusal hook

The internal helper Claude Code uses to write files and other artifacts safely (writing to a temporary location and then swapping it in, so a crash never leaves a half-written file) now supports a beforePublish check that runs just before the write completes. If that check returns false, the write is aborted, a new PublishRefusedError is thrown, and nothing is published, including cleaning up any empty placeholder file that may have been created along the way.