Address review round 3: id limit, private temp files, canonical ids

- add() refuses to create an id that load() would reject; the CLI reports it
- save() creates the temp file with the real file's mode (and O_EXCL), so a
  private list is never briefly world-readable; one stat call; symlink
  resolution inlined; comment states the rename trade-offs
- CLI rejects ids with leading zeros and id 0
- Tests for trimming, the bare 'todo' default, and the id limit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/todo.test.js

@@ -43,6 +43,10 @@ test("load returns an empty list for a missing file", () => {
   assert.deepEqual(load(tempFile()), []);
 });
 
+test("add refuses an id that load() would reject", () => {
+  assert.throws(() => add([{ id: Number.MAX_SAFE_INTEGER - 1, text: "a", done: false }], "b"), /No ids left/);
+});
+
 test("add handles a very large list", () => {
   const todos = Array.from({ length: 200_000 }, (_, i) => ({ id: i + 1, text: "x", done: false }));
   assert.equal(add(todos, "y").at(-1).id, 200_001);