fix(mh3g): separate repair reference and output paths

[VincentAdamNemessisX]

Summary

• split repair mode into three explicit path roles: original 3DS source, read-only current Wii U/Cemu reference, and independent repaired output
• bind dry-run/write authorization to source, current, output, and preview hashes
• add the same guided controls and copy to Windows WinUI and macOS SwiftUI
• preserve legacy CLI in-place behavior only when --output is omitted; native UIs always pass it explicitly
• document separate-output guild-card initialization and manifest v1/v2 rollback compatibility

Safety semantics

• the current Wii U/Cemu save is read-only
• only the selected output path is writable
• explicitly choosing the same current/output path remains a deliberate in-place repair
• quest/system/cec/phrase data retain their documented compatibility boundaries

Verification

• cargo test -p mh3g-save-convert — 220 passed
• cargo clippy -p mh3g-save-convert --all-targets -- -D warnings
• cargo clippy -p mh3g-save-convert --target x86_64-pc-windows-msvc --all-targets -- -D warnings
• swift test — 72 passed
• python3 scripts/mh3g-docs-contract.py
• python3 scripts/verify-mh3g-save-converter-windows-source.py
• macOS app build + synthetic smoke passed

Unverified boundaries

• Windows native WinUI compile/runtime still requires a Windows runner or machine
• no Cemu gameplay/runtime validation was performed
• no real MLC or emulator save was modified