fix(scaffold): write conflict markers on manual merge, fix init --update, fix --force+--update - #3047

CI's pre-commit hook (atmos validate --affected, EditorConfig checks) flagged
3-space continuation-line indentation under numbered list items as invalid --
.editorconfig requires markdown indent_size=2, so continuation lines must be a
multiple of 2 (4 spaces here), not 3.

…ntinels

- HasUnresolvedConflictMarkers now requires an exact match on the opening
  <<<<<<< Ours marker instead of a prefix match, so unrelated content that
  merely starts with that text (e.g. a trailing suffix on the same line)
  can't false-positive.
- YAMLMerger's conflict sentinels now include a random hex suffix and are
  checked against the full base/ours/theirs text before use, so a
  pre-existing scalar value that happens to equal a sentinel can no longer
  be mistaken for a real conflict placeholder and corrupted.

… command state

Use a fresh *cobra.Command with initCmd's flags registered (mirroring the
existing scaffold_coverage_test.go pattern) instead of initCmd.SetArgs/Execute
on the shared package-level initCmd, so --set/--interactive/positional args
can no longer leak into later tests. cmd.NewTestKit can't be used here since
cmd/init can't import cmd (cmd already blank-imports cmd/init, which would
create an import cycle).

…cmd/scaffold

cmd/init previously took the concrete *ui.InitUI type directly, so its
interactive-flow branches (prompt, base-ref-offer/confirm-retry) could
only be exercised end to end with a real TTY. Extract InitUI (the
subset of *ui.InitUI's behavior cmd/init depends on) and a generated
mock, matching cmd/scaffold's existing ScaffoldUI/MockScaffoldUI
pattern, and add mock-based tests covering the offer/confirm/decline
and error-propagation branches of runInitInteractiveFlow,
runInitTargetedFlow, and resolveInteractiveInitBaseRef.

…ct gaps

Add cryptoRandRead (rand.Read indirected through a package-level var)
so tests can force randomSentinelSuffix to fail -- crypto/rand.Reader
never errors on any platform Atmos supports, so this branch (and every
return-err propagation line above it in mergeMappings/mergeSequences/
pickConflictValue) was otherwise unreachable from a test.

Also cover two previously-untested-but-reachable paths: a multi-line
scalar conflict (inlineConflictBlock's per-line loop) and mergeMappings'
kind-mismatch dead-code check is confirmed unreachable (mergeNodes
already intercepts any kind divergence before dispatching to
mergeMappings), documented rather than force-tested.

…te failures

Add newAtomicWriteFS (writeFileSecure's overwrite path indirected
through pkg/filesystem's existing FileSystem interface/mock) so tests
can force WriteFileAtomic to fail. mergeFile's two writeFileSecure
call sites (conflict-markers write and clean-merge write) previously
had no way to reach their ErrFileWrite branches: existingPath must
stay a valid, readable regular file through the earlier os.ReadFile,
then fail specifically at the write step, which the directory-in-place
trick used elsewhere doesn't reach.

New-sentence line started with a lowercase package identifier
(crypto/rand.Reader), which the godot linter flags as not starting
with a capital letter.

…licts

MergeResult gains HasMarkers, distinct from HasConflicts: a
document-stream-level conflict (the user's stream dropped a document the
template changed) has no ours/theirs node pair to splice inline
<<<<<<</=======/>>>>>>> markers from, so the template's version is kept
verbatim instead. mergeFile's conflict hint now checks HasMarkers before
telling the user markers were written to the file.

renderConflictBlock's trailing suffix (whatever followed the sentinel on
the original line -- a flow-style closing `}`/`]`, or an inline comment)
was only appended to the closing >>>>>>> Theirs marker line. Since only
one alternative survives manual conflict resolution, deleting the other
block (or just the marker lines themselves) silently dropped that
trailing content, breaking flow-style YAML or losing a comment.

Append it to each alternative's own last content line instead, guarded
against duplicating a comment addNodeConflict's sentinel already carried
over from ours' own encoding.

…behind

The documented multi-sentinel-per-line limitation (flow-style YAML like
{a: 1, b: 2} can put two conflicts on one encoded line) previously left
the second sentinel as literal ATMOSMERGECONFLICT... text, since only
the first match on a line was ever spliced into real markers.

appendTailToLastLine now recurses: when the trailing text after a
sentinel still holds another one, that conflict's own markers are
spliced in as a nested block instead of being left as placeholder text.
Every sentinel on a line is drained, at the cost of harder-to-hand-resolve
nested markers for this already-rare edge case -- never silently dropped
or corrupted content.