feat: live transitions in prompter style with interrupt-safe recording

[This-Is-NPC]

Before

• No live (in-recording) scene transitions; transitions could not be composited during a take.
• Recording could be left in an inconsistent state on interrupt; a SIGINT during command/process startup risked killing a half-spawned process group or running cleanup twice.
• Prompter popup had limited styling control (no header/class/style fields).
• Scene path resolution returned the raw, non-canonical path, leaving a symlink-swap (TOCTOU) gap.

After

• Hypr-overlay live transitions wired through scene validation, the engine step loop, and multi-scene production stitching.
• Interrupt-safe recording: a command guard that cannot kill a half-spawned process group, plus an interrupt guard that runs cleanup exactly once and exits 130.
• Reworked prompter popup with style, header, and class fields.
• Scene path resolution canonicalizes the symlink-resolved prefix and rejects root escapes, while still allowing creation of not-yet-existing output paths.

Summary of changes

Aspect	Change
Live transitions	New transition step type, validated and rendered as a Hypr overlay; stitched across scenes in production
Interrupt safety	command_guard.go + interrupt.go: guard holds the mutex across cmd.Start(); cleanup runs once, bounded by a timeout
Prompter popup	Style/header/class fields; single-quoted + control-char-stripped inputs into the popup driver
Path hardening	SafePath returns the canonical symlink-resolved path instead of raw abs
Production	Multi-scene stitching with transitions and atomic concat-replace

Files updated

• internal/engine/ (engine.go, actions.go, command_guard.go, interrupt.go + tests)
• internal/transition/transition.go
• internal/production/production.go
• internal/prompter/ (hypr_popup.go, prompter.go)
• internal/recorder/gpu.go
• internal/scene/ (loader.go, paths.go, types.go, validate.go)
• internal/cli/cli.go
• .docs/ (configuration, how-it-works, scenes)

Validation

Scenario	Outcome
go build ./...	Success
go vet ./...	No issues
go test ./...	83 pass (10 packages)
go test -race (engine/scene/prompter)	54 pass, race-clean
Audit pass (review + security lenses)	No error-severity findings; warnings resolved

Deviations

Criterion	Deviation	Rationale
One intent per commit	Code shipped as a single feat commit	Subsystems share test files; finer intent splits would orphan tests from their code (no hunk-level staging)
Step-loop fail-soft	Kept (not changed to abort-on-error)	For a live recorder a partial take beats a discarded one; error still surfaced via errors.Join + stderr

Risks / follow-ups

• SafePath TOCTOU hardening assumes a single-operator trust model; revisit if scenes ever come from untrusted sources.
• Shell-substitution safety in transitions depends on the safeNameRE invariant — any future placeholder sourced from a non-validated field would reintroduce injection risk.

References

• Commits: 4694a4e, 7833589
• Branch: feat/live-transitions-prompter-style