Preserve OCR outputs on save failures and fix Welcome action inputs

[lukisch]

A two-page OCR job previously reported success after an empty OCR response silently omitted one page. OCR, merge, and manifest writes also wrote directly over existing targets, so a later save failure could destroy the previous output.

This change requires every rendered source page/frame to produce exactly one PDF page. It stages complete output beside the target, reopens PDF stages to verify their page count, closes lazy sources before publication, and replaces the target only after successful writing and validation. Failed disk fallbacks stay in the private stage directory.

Merge inputs and their filesystem aliases cannot be replaced by the merge target. Individual results are archived by completing a staged copy before removing the original. The GUI distinguishes a saved collective PDF from later archiving errors; API callers can collect warnings or inspect MergeArchiveError.merged_path. Manifest failures show an error without success feedback. Cleanup failures are reported separately from processing/publication status.

Validation: 163 passed, 1 skipped (the intentionally unversioned AUFGABEN.txt check); Ruff, compileall, and git diff --check passed. Seven new behavior counterexamples failed on unchanged master; the final suite adds 19 regression cases. An independent isolated review passed 30 cases on the first commit and 8 focused cases on the final delta, including real Windows sharing/readonly failures, TIFF page order, pikepdf lazy-source lifetime, Unicode/serialization failures, and malformed or wrong-page PDF stages. Review is bound to 74bde99.

Version remains 1.1.4. No executable, release, Store submission, or general OCR-accuracy claim. External path races and batch/archival multi-file transactions remain outside this change; SAVE_SAFETY.md records the limits.

The final follow-up commit 7d21427 fixes three Welcome action input names to match the official first-interaction v3 metadata. Its independent delta review passed; product sources are unchanged and the full local suite still passed 163 tests with one expected skip. Five product checks and assignment passed on predecessor 74bde99. The original Welcome run failed on the base branch's hyphenated input names: pull_request_target reads the base workflow, so pushing this fix does not establish a successful Welcome run. No extra comment or issue was posted to test it.

Draft pending current-head CI and the repository's required review/merge by a different model class. The independent technical reviews above do not assert that separate merge requirement is satisfied.