Fix finance validation and write safety inconsistencies

[id774]

Summary

• An explicit --config/FINANCE_CONFIG file that does not exist now fails
  as a ConfigurationError instead of silently falling back to defaults.
• Malformed YAML is reported as ConfigurationError ("...not valid YAML...")
  instead of an unhandled yaml.YAMLError traceback.
• jquants.timeout/request_interval reject nan/inf/-inf via
  math.isfinite(); retention_days now has a MIN_RETENTION_DAYS = 281
  floor, derived from max(SMA_PERIODS) == 200 and pinned by
  test/test_plan_window.py.
• Settings tracks whether history_dir was explicitly configured
  (FINANCE_HISTORY_DIR / paths.history_dir). --data-dir now preserves
  an explicit history directory by provenance rather than by comparing it
  to the derived default value.
• finance-charts -y/--days rejects negative values (usage error, exit 2);
  finance-summary -r/--range rejects values below 1.
• finance/stocklist.py now refuses a stock-list record with an empty
  required code or name (DataFormatError) instead of silently skipping it;
  only a true blank line (an empty CSV row, or a single whitespace-only
  field) is skipped.
• finance/datasources/jquants.py::_message() redacts the configured
  API key (str.replace on every occurrence) from a provider error message
  before truncation, so an echoed key cannot reach an exception, stderr or
  the job log.
• finance/storage.py writes stock_CODE.csv, ti_CODE.csv, summary
  tables and data_source.txt atomically: content is completed in a
  sibling temporary file (created at mode 0o666 & umask) and moved onto
  the target with os.replace() only after the write succeeds; an existing
  target's mode/uid/gid are carried onto the replacement, and a failure at
  any point leaves the last good target untouched. ModelStore.save() and
  the PNG writer are unchanged.
• Documentation corrections: README/BASIC_DESIGN/DEPLOYMENT/config.yml.sample
  wording brought in line with the above, the stale "touches neither data/
  nor clf/" deployment claim removed, the testing-group and command-count
  text corrected, and doc/VERSIONS' unreleased v1.0.2 entry consolidated
  to the final state.

Compatibility

• Valid configuration precedence, defaults and the absent-implicit-
  ./config.yml behavior are unchanged.
• Valid CLI option names, defaults and -y 0 (all-history) meaning are
  unchanged.
• Generated file schema, separators, index labels, key order and every
  formula (indicators, models, aggregation ratio) are unchanged.
• Chart prefix thresholds and chart-only no-fetch behavior are unchanged.
• cron.d/, run.sh and deploy.sh runtime behavior are unchanged (not
  modified).
• Dependency set is unchanged; no pyproject.toml change, no new
  third-party import.
• The default test suite still makes no network request and needs no API
  key.

Version

• Repository release version remains candidate 1.0.2 (pyproject.toml
  and finance.__version__ unchanged).
• doc/VERSIONS top entry remains v1.0.2 (Release Date: TBD).
• File-level module versions bumped: finance/config.py v1.2,
  finance/cli/__init__.py v1.2, finance/cli/charts.py v1.2,
  finance/cli/summary.py v1.1, finance/stocklist.py v1.1,
  finance/datasources/jquants.py v1.2, finance/storage.py v1.1. Test
  modules were not version-bumped (assertions/coverage only).

Validation (actual results)

• pytest: 513 passed, 2 deselected (integration), 1 pre-existing warning.
• ruff check .: All checks passed!
• sh -n run.sh: OK
• sh -n deploy.sh: OK
• git diff --check: no whitespace errors

🤖 Generated with Claude Code

https://claude.ai/code/session_01QzJ43B843Qb2NNM2TZ1aYd