Add --apply flag to write fixes in place

[alphacrack]

Summary

Add an --apply flag that writes the LLM-fixed code back into the working tree (in place), instead of only into fixed/. Today the tool never mutates the user's files — you always have to copy from fixed/ manually.

Why

Several downstream features want this (the hybrid post-fix re-verification in the related issue notes that a temp-dir dance is "cleaner with an --apply flow"). It's also the single most-requested ergonomic improvement for the fix workflow.

Design notes / guardrails

• --apply must be opt-in and loud: print exactly which files will be overwritten, and honor the AI-generated banner policy.
• Refuse to apply if the working tree is dirty (or require --apply --force), so users can always git diff the result.
• Keep the default behavior (fixed/ only) unchanged.
• Consider a --apply --dry-run that lists the diff without writing.

Acceptance criteria

• --apply writes fixes in place with a clear pre-write summary.
• Dirty-tree guard (or explicit --force).
• Default (no --apply) behavior unchanged.
• Tests for apply / dry-run / dirty-tree-refusal.

Notes

Design-sensitive (it's the one path that mutates user files). Please open a short design comment before coding. area:cli, area:orchestration. Not a first issue.

[alphacrack]

Related: #61 (hybrid post-fix re-verification) depends on this — re-running the rule engine on fixed code is cleaner with an --apply flow.