fix(hooks): UTF-8 stdin, atomic multi-DB save, and unique backup dirs in update-db.py

[otsune]

Summary

Three related data-integrity fixes for update-db.py, found when a real session update crashed mid-save on Windows/Git Bash and left the six databases mutually inconsistent (stats double-counted after retry).

1. force_utf8_io() now reconfigures stdin (fluent_paths.py)

Under an ASCII/C locale (Git Bash on Windows), a piped session payload containing CJK text was decoded with surrogateescape. The lone surrogates survived JSON parsing and only blew up at re-encode time — i.e. during the save loop, after learner-profile.json and progress-db.json had already been written. Retrying then double-counted sessions/exercises/minutes.

2. Two-phase commit across all six databases (update-db.py)

Replaced the per-file save_json() loop with save_all(): every database is staged to a .tmp file (with fsync) first, and only when all six serialize successfully are they swapped in via rename. A serialization/encoding error now exits 2 before any real database is touched, so the documented "no files were modified" guarantee in docs/DB_SCRIPTS.md actually holds. Stale .tmp files are cleaned up on failure.

3. Pre-update backups are never overwritten (update-db.py)

backup_all() previously reused pre-update-<session_id>/, so retrying the same session id overwrote the only backup taken before anything went wrong. It now creates numbered siblings (pre-update-<id>-2, -3, …), preserving the earliest (pre-corruption) backup.

Also

• Test suite file reads now pass encoding="utf-8" — test_milestone_non_latin_distinct_nonempty_ids failed on Windows default locales (cp932) before this.
• Four new regression tests: CJK payload roundtrip, forced LC_ALL=C run, backup preservation on retry, and save-failure atomicity (all six DBs byte-identical after a forced staging failure).
• docs/DB_SCRIPTS.md side-effects section updated to match; CHANGELOG entry added under Unreleased (version bump left to the maintainer).

Test plan

• python3 tests/test_update_db.py — 16 tests pass on Windows 11 / Git Bash / Python 3.10 (12 existing + 4 new; the new CJK tests fail before the fix, pass after)
• Real-world repro: the originally-crashing Japanese payload now updates all 6 databases in one pass without PYTHONUTF8=1

Co-Authored-By: Claude noreply@anthropic.com