Save integrity: delegated edit tracking, generation guards, transactional open (#403 Phase A)

[maboa]

Part of the #403/#404 Phase A push. The working-copy layer needs the data-loss guards before the legacy storage is deleted.

1. One central markEdited(reason) wired by document-level delegation (Element.closest), not direct element listeners — the caption-mode round trip replaces #hypertranscript, silently killing direct listeners. Cover: transcript/caption/title/summary/topics input, caption-control and persisted-option change, the strike-through toolbar (mutates styles without input), and semantic events for caption regeneration/programmatic edits. Suppression scope around open/restore apply. Dirty state becomes synchronous, not inferred from OPFS timestamps.
2. Per-tab lifecycle state: identityGeneration (bumps on open/import/new-project commit), editGeneration (bumps per edit), dirty, saveInFlight, autosaveInFlight. Capture generations before gather; on completion, apply only if identity still matches; mark clean only if the edit generation also matches; serialize autosaves (one follow-up write, never parallel); finally clears in-flight flags.
3. Transactional open/import (prepare → apply → commit): stage the incoming project fully before touching DOM or work state; apply under suppression with explicit success/throw; only on success switch identity/session and clear the OLD working copy. Never clear old work before replacement commits. Download marking must check that no edits landed during zip generation.
4. Single-file crash snapshot: collapse the recovery snapshot to one snapshot.json (everything except media; media copied once, immutable) — eliminating multi-file torn-snapshot states without staging/revision machinery. Empty captions are unambiguous by construction. Boot restore awaits recovery apply before enabling editing; a failed restore clears the boot hint instead of retrying forever.

[maboa]

Core landed on the #404 branch as ca85d88:

• Delegated markEdited (item 1): document-level delegation across transcript / caption editor / summary / topics / future title field / strike-through toolbar / focusout — regression-tested against the caption-mode round trip that killed the direct listeners (edit after the round trip must reach the snapshot).
• Lifecycle state (item 2): editGeneration + identityGeneration (bumped at open/restore/new-transcription/session-end), saveInFlight refusing overlapping container builds, serialized autosaves with a single follow-up, and clean-marking gated on both generations being unchanged since gather — a download during which edits landed stays dirty. (The synchronous sessionEdited flag from the switch-guard work graduated into this.)
• Single-file snapshot (item 4, simplified per the review comment on glider#172): snapshot.json carries project json + transcript html + captions-or-null in one write — torn multi-file states are structurally impossible, absent captions are unambiguous. Boot restore reads it (legacy per-file fallback for pre-Save integrity: delegated edit tracking, generation guards, transactional open (#403 Phase A) #448 work dirs), clears the boot hint on validation failure instead of retrying forever, and carries the envelope so §8.1 preservation holds across the crash path.

Remaining from item 3: open/import is validate-before-confirm and apply-before-clear already; the full staged prepare→apply→commit (complete apply-model with explicit empties, staging revision cleanup on failure) stays open here.

[maboa]

Shipped in the Phase A merges and verified against current main: central document-delegated edit signal (survives the caption-mode element swap), edit/identity generation guards on async completions, serialized snapshot writes, and a synchronous dirty flag. Closing.