fix: init validation, build-sbf lockfile, profile server truncation

[L0STE]

Closes #91, closes #92, closes #94

---

#91 — Init: validate target directory before prompting

scaffold() checked for conflicting files (existing Quasar.toml, Cargo.toml, non-empty directory) but only after the user had already answered every interactive prompt. Extracted the validation into validate_target_dir() and call it in run() immediately after the project name is resolved — before toolchain, test language, template, and git prompts.

#92 — Build: toml_datetime edition 2024 error with Solana toolchain

cargo build-sbf uses Solana's bundled cargo (1.84), which cannot parse crate manifests that declare edition = "2024". Scaffolded projects had no Cargo.lock, so Solana's cargo performed full dependency resolution and choked on transitive dev-dependencies like toml_datetime >= 1.1.

Two-layer fix:

1. Init time — scaffold() now runs cargo generate-lockfile after writing project files, using the system cargo (which handles edition 2024). Every new project starts with a lockfile. If this fails (no network, etc.) it prints a note rather than aborting, since the project files are already on disk.

2. Build time — ensure_lockfile() runs before cargo build-sbf. It compares Cargo.toml and Cargo.lock mtimes and skips entirely when the lockfile is already current (zero overhead on normal builds). When the lockfile is missing or stale it regenerates with the system cargo. If regeneration fails and no lockfile exists, it exits with a clear diagnostic pointing at rustup update instead of letting build-sbf produce a confusing edition error. If it fails but a stale lockfile exists, it warns and continues since the existing lockfile often still works.

#94 — Profile flamegraph truncated for large JSON

run_server() sets the TcpListener to non-blocking for idle-timeout polling. Accepted TcpStreams inherit this flag. When serve_file() calls write_all() on a non-blocking socket and the kernel send buffer fills (~128–300 KB), write_all returns WouldBlock — silently discarded by the let _ = pattern. Any profile JSON larger than one send buffer was truncated, producing ERR_CONTENT_LENGTH_MISMATCH in the browser.

Fix: set_nonblocking(false) at the top of handle_connection(). The blocking server (--diff mode via serve_blocking()) was never affected because it uses a blocking listener.

[github-actions]

⚡ CU Benchmark (Vault)

Instruction	Base	PR	Delta
Deposit	1,577	1,577	0 ⚪
Withdraw	411	411	0 ⚪

Binary size: 6,888 bytes (0 ⚪ bytes)