fix(encode): publish the output only once the render succeeds

[LeadcodeDev]

Severity Medium, category correctness. Location: crates/rustmotion/src/encode/video/ffmpeg.rs:620

Impact

When render_frame_task fails mid-encode (line 613 sets pipe_error and breaks), the code drops stdin and then waits for ffmpeg. ffmpeg sees a clean EOF on pipe:0, finalizes the frames it already received, writes the moov atom and exits 0. rustmotion then returns Err, but output_path now holds a structurally valid MP4 containing only the first N frames. Because ffmpeg_args emits -y (line 194), this also silently destroys a previously-good render at the same path. A user scripting rustmotion render who checks only file existence (or whose CI publishes the artifact) ships a truncated video. No code path anywhere in src/cli or src/encode removes the output on failure — only test code calls remove_file on outputs.

Fix

On the pipe_error path, call child.kill() and child.wait() before returning, and let _ = std::fs::remove_file(output_path); on both the pipe_error and !status.success() branches. Better still, have ffmpeg write to a sibling scratch path and fs::rename onto output_path only after a clean exit — the same promote-on-success discipline video_audio.rs::partial_wav_path already applies to cached WAVs.

Evidence the audit read

drop(stdin);
...
    let status = child.wait().map_err(|e| RustmotionError::FfmpegWait {
        reason: e.to_string(),
    })?;
...
    if let Some(e) = pipe_error {
        tee_stderr();

Based directly on the chantier branch.

Part of the September 2026 audit remediation chantier. Refs #220 (RM-17).