fix(cli): reject hard-linked aliases of program inputs as outputs

[oxura]

Fixes #1495.

The CLI already refuses an output that is a program input by resolved path. A hard link has a different path but the same file identity, so JS emission truncated the original input and a subsequent run failed to parse it.

Compare existing output (dev, ino) against all loaded Bend and foreign input identities, using bigint stats to avoid rounding file IDs. Build the identity set lazily only when an independent existing output needs comparison; fresh outputs and already-known path/directory rejections do not stat every input. Keep the existing output error and ordinary independent output overwrite behavior.

A permanent installed-CLI assertion in the existing ping gate refuses a hard-linked sum.bend output, then runs the original input and expects 5n. The exact assertion fails against the unchanged source CLI and passes against the real rebuilt standalone CLI. It does not pin diagnostic wording or inspect implementation source. README documents file-identity protection; GUIDE/CHANGELOG and gate caps/policy are unchanged.

Actual local verification on Linux x64:

• Current-main reproduction: -o alias.js exits 0 and overwrites the input; rerunning that input exits 1 with a parser error.
• Source and standalone fixed CLIs refuse the original hard link and the original program still runs.
• Both CLIs refuse hard-linked imported Bend and real host-effect JS inputs, same-path inputs, symlinks and directories. Both preserved dependency programs still run (42n and the real host cwd).
• Fresh outputs and an independent existing output compile successfully; all six resulting Bun/Node consumer executions match the original program output.
• Exact new ping assertion executed fail-before/pass-after against real CLI processes.
• bun gates/repo.ts: 54/54.

The full installer/archive/hub ping flow was not run: its sibling site checkout is absent and the referenced GitHub site repository is not accessible here. Executing the isolated new assertion is not a claim that the full ping gate passed. This checks identity at validation time; it is not a claim of race-proof concurrent filesystem protection.

[nicolas-abril]

Unsupervised AI review (Claude, run by @nicolas-abril). Nobody has read this by hand yet, so please double-check it.

I pushed f0327f1 on top of this PR. It keeps the same behavior with less code:

• The PR checks the real path first, then builds a set of dev:ino ids for an output that already exists. The ids alone cover every case: a symlink stats to its target, a hard link has the same inode, and a path that doesn't exist falls back to its resolved name.
• So path_real (only used here) becomes path_id(p), which returns dev:ino, or "" for any directory, or the resolved path for a missing file. The guard is now ins.has(path_id(out)).
• main.ts is now +37 tokens over main instead of +131.

Checks on macOS (M-series):

• gates/repo.ts 54/54, gates/ping.ts 48/48 (this includes your hard-link case), gates/test.ts 1602/1602.
• Ran by hand: a hard link, a symlink, a directory and the input itself as -o are all rejected; a new output path is written.

I didn't touch the README note or the ping test.