Add profile and save persistence, wired into the three autoloads

scripts/profiles/: SaveIO handles real file I/O in user://saves (one
file per profile_id, atomic write via temp-file-then-rename, backup
copy before each overwrite, corrupted-main falls back to backup,
schema-invalid content is rejected like corruption). SaveMigration
and SaveFactory are pure; SaveMigration refuses a schema_version it
doesn't recognize (older or newer) rather than guessing. ProgressUpdates
is pure and wires ReviewScheduler/DifficultyManager onto a save's
skills dict, including per-session overdue-review marking.

The three autoloads (SaveManager, ProfileManager, ProgressManager)
stay thin: in-memory current-profile state and orchestration only,
no logic of their own, so the actual behavior lives in the tested
pure/file-IO modules above rather than in untestable glue.

26 new headless tests, including the failure modes called out in the
launch prompt: a truncated .tmp file never corrupts the readable
save, a corrupted main file falls back to its backup, two profiles
never mix (down through the real autoload layer, not just SaveIO),
and an unknown future schema_version is rejected outright.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/profiles/save_factory.gd

@@ -0,0 +1,17 @@
+class_name SaveFactory
+extends RefCounted
+## Construit une nouvelle sauvegarde vide pour un profil, conforme a
+## data/schemas/save.schema.json. Code pur.
+
+
+static func new_save(profile_id: String, display_name: String, school_level: String) -> Dictionary:
+    return {
+        "schema_version": SaveMigration.CURRENT_SCHEMA_VERSION,
+        "profile_id": profile_id,
+        "display_name": display_name,
+        "school_level": school_level,
+        "session_count": 0,
+        "unlocked_regions": [],
+        "skills": {},
+        "rewards": {"stars": 0, "items": []},
+    }