Prevent source data loss when conversion input and output refer to the same file

[Jaeyou PARK (cpuu)]

Converting an image with the same input and output file currently truncates the source before reading it. Different paths that are hard links to the same file can cause the same data loss.

For forensic workflows, accidentally selecting the source as the output should not destroy the evidence being processed. This PR rejects that operation before truncation and reports an error asking the user to choose a different output path. An explicit failure also works in unattended workflows without requiring an interactive prompt.

Existing checks do not prevent this case: NoConversionRequired rejects matching formats, not matching files; Unix O_NOFOLLOW rejects output symlinks but not identical paths or hard links; and input canonicalization does not compare source and destination identities. The payload checks added in #884 run after the destination has already been opened with truncation.

The change opens the destination without truncation, compares the identities of the already-open source and destination files using same-file, and truncates a regular destination only after confirming that it is distinct. Existing Unix output-symlink rejection and support for non-regular destinations are preserved.

Regression tests cover:

• Identical paths and hard-link aliases across all six supported format conversions, verifying that the original bytes remain unchanged.
• A source symlink resolving to the destination.
• Successful conversion to new and existing distinct output files.
• Existing Unix output-symlink rejection and /dev/null output.

On the unmodified baseline (78113519), two new tests fail because the source becomes empty. With this change, all 30 library tests, 6 conversion tests, and 4 new integration tests pass on Linux aarch64. Formatting and scoped strict Clippy checks also pass.