Add sp promote: graduate a scratch into the working tree

[rwrife]

Closes #8

What

Adds sp promote <id> [dest] — the "oops, keep this" escape hatch. It moves a scratch's content file out of the store and into the working tree, then drops the entry from the index so the promoted file is the repo's to keep (and the reaper can't touch it).

Behavior

• sp promote <id> → moves into the current dir, named from a slug of the scratch's name (its id when unnamed), preserving the extension.
• sp promote <id> ./dir → existing-directory dest drops the file inside as <slug>.<ext>.
• sp promote <id> path/keep.md → any other dest is the full target path (renames on the way out), creating parent dirs as needed.
• --force → overwrite an existing destination. Without it, promote refuses and leaves the scratch untouched in the store (non-destructive guard).
• --no-open → skip opening the promoted file in $EDITOR. A missing $EDITOR is never fatal — the move already happened.
• Works on morgued scratches too; the id may be an unambiguous prefix.

Acceptance criteria

• sp promote <id> [dest] moves the scratch out of the store into cwd (or dest)
• Removes the scratch from the index once promoted
• Refuses to overwrite an existing file without --force
• Opens the promoted file in $EDITOR after moving (unless --no-open)
• Clear confirmation message showing the new path

Implementation notes

• Core move+forget lives in store.Promote (reuses the existing cross-device-safe moveFile); it moves content first and only drops the index entry after the content has safely landed, rolling the move back if the index write fails — so a scratch is never lost between the two steps.
• New sentinel store.ErrDestinationExists drives the CLI's --force hint.
• Guards against promoting a scratch onto its own store file.
• Pairs with the future secret-tripwire check ([feature] Secret tripwire — detect & block secrets in scratches #9), which will hook into promote.

Tests

• internal/store/promote_test.go — move-out + index drop, promote from morgue, overwrite refusal (non-destructive), --force, nested-dir creation.
• internal/cli/promote_test.go — full CLI flow: default cwd, directory-dest slugging, explicit rename, --force, prefix resolution, unknown-id error, refused-overwrite leaves scratch listed.

go build ./..., go vet ./..., go test ./..., and gofmt -l all clean; no new dependencies (go.mod stays tidy). README updated with a sp promote section + quickstart line.