CLI summary pair publication

Trap: two individually atomic writes look like atomic report publication, but second-write failures or concurrent runs can leave JSON and Markdown from different generations, including a stale open gate; failures before writing and BaseException bypasses can preserve both old outputs. Fix: publish both summaries as one coherent generation with rollback/commit semantics, and guarantee every nonzero exit leaves each artifact absent or unambiguously closed while preserving the original error.