Default runs can publish a mask that changed after its last fingerprint check #198

Release blocker found by the external review of #160 (ChatGPT batch 17, claim D3).

In a default run (no verify_content), the last fingerprint check of the masks is at run/pipeline.py:368-377.`` After that check:

1. the report is written and the context exits;
2. _commit flushes every staged file and writes the publication record;
3. because before_commit is None for a default run, it then replaces the manifest (run/generation.py:121-158).```

A mask whose fingerprint changes during that interval is published without mask_changed_during_run. Strict runs do not have this gap, because their SHA-256 check is the before_commit callback.

Fix:

• Run the final callback for default runs too, and re-check every mask fingerprint in before_commit.
• In strict mode, run the fingerprint check plus the existing content SHA-256 check there.
• Add a regression test that rewrites a mask after the staged-body check but before the manifest is replaced. It must fail on today's code.