Fix reforge workspace isolation and durable result publication

[0z5a]

Concurrent reforge calls currently overwrite /tmp/reforge_current.cubin and /tmp/reforge_best.cubin. Give each call an owned temporary workspace and atomically publish a durable best cubin without overwriting existing output or the input.

Adds optional --output / --work-dir and state.best_cubin_path; existing invocations retain defaults. Mutation/search policy is unchanged.

Validation	Result
Forced 2/8-process baseline race	Reproduced token corruption
Workspace/publication/CLI tests	11 passed
Numerical SM120 integration	1/2/4/8 GPU workers passed
Original fixture tests	7 skipped; original fixture unavailable

Validation details. Multi-GPU evidence uses the integrated snapshot/swap fixes and a known numerical ABI. No kernel speedup is claimed for file isolation.

Replayable integration fixtures are preserved on the integration branch.