Change Pipeline

The model does not generate the authoritative diff and does not write the workspace. Existing files require one unique exact old fragment. New files require an explicit create operation under an existing safe parent. Multi-file apply uses best-effort rollback and is not crash-atomic.