fix(cli): scaffold projects without partial mutations

[dvd233]

Summary

• fail before npm metadata lookup or template download when the selected project path already exists
• share one failure-safe scaffolding implementation between @flowgram.ai/create-app and @flowgram.ai/cli
• download, extract, and rewrite FlowGram dependency versions in an isolated staging directory
• atomically claim the absent destination with a non-recursive mkdir, then clean the tarball, staging tree, and any destination owned by the failed attempt
• add filesystem regressions for existing paths, dangling links, empty and populated destination races, falsey thrown values, download/extraction/preparation failures, and the successful path

Behavior choice

An existing destination already made the old flow fail during renameSync. This keeps that no-overwrite outcome, but moves it before npm/network work and prevents the failed command from rewriting the existing project's package.json or leaving extraction artifacts behind.

The final destination claim uses mkdir rather than a check-then-rename sequence, so a concurrently created empty directory is not replaced on POSIX filesystems.

The npm query syntax is intentionally unchanged; the separate command cleanup in #1136 remains independent of this fix.

Validation

• rush build
• rush lint --verbose
• rush ts-check
• rush test:cov
• Node.js 18.20.8: 9/9 @flowgram.ai/create-app regression tests
• Node.js 18.20.8: live registry scaffolding through both public entry points, with all 15 FlowGram dependencies rewritten to 1.0.14
• Node.js 18.20.8: both public entry points preserve an existing sentinel and do not invoke npm
• ESM and CJS @flowgram.ai/create-app/scaffold subpath imports
• npm pack --dry-run --json confirms the scaffold ESM/CJS/type outputs are published and tests are excluded

Fixes #1172

AI assistance

I used an AI coding assistant during implementation and testing. I reviewed the complete diff and validation results and take responsibility for the change.