feat: per-row file output — write a folder of documents, not just a table

[mirpo]

Summary

A write step's source now picks its mode: from: writes one file with every row (a dataset or report — today's behavior), forEach: writes one file per row (a folder of documents). That closes the content half of the office loop — N rows → N documents, next to N rows → 1 table.

  - name: reply_digest
    from: drafts                          # → one replies.md table of all drafts
    write: replies.md

  - name: reply_files
    forEach: drafts                       # → one file per draft
    write: replies/{{.item.subject}}.md   # path is a template, rendered per row
    content: "{{.item.reply}}"            # body is raw text, not JSON

• content: is the file body as raw text — that is what makes the output a document rather than a record. Omit it and the single row is serialized by extension instead (.json, .csv, …), one row per file, reusing the same writers as aggregate mode.
• The path template may nest (out/{{.item.kind}}/{{.item.id}}.md); missing directories are created.
• Exactly one of from/forEach is now required on a write step, and a per-row path without a template is rejected — otherwise every row would overwrite the same file. Both templates are parsed at config time so a typo fails in validate, not mid-run.

Filename safety, split by origin

A path rendered from model output is a real hazard, so slashes are treated differently depending on where they come from: the path is rendered against a copy of the row whose strings are already filename-safe, so a slash you write in the template still nests directories, while a slash inside the data cannot redirect the file.

This came out of a failing test — sanitizing the final path segment (the original plan) is too late, because filepath.Split has already turned a data slash into a directory.

Also: a name that renders empty falls back to the row number, and two rows rendering the same name get numbered (-2) with a warning rather than silently clobbering each other.

Commits

1. feat: config for per-row write steps (forEach + content)
2. feat: fs.SanitizeFilename — both slash kinds replaced regardless of platform, so a name written on one OS cannot escape its directory on another
3. feat: per-row fan-out in the write step (+ extracted serializeRows, shared by both modes)
4. test: e2e per-row pipeline
5. docs: inbox-triage emits per-row reply drafts + README

Verification

• Full go test ./... + golangci-lint green; datamatic validate passes on every example.
• New tests cover: all 10 config/guard cases, the sanitizer, per-row content bodies, sanitize+collision+empty-name fallback, content-less serialization, and an end-to-end read → LLM → folder-of-documents run.
• Live-run on Ollama (qwen3:1.7b): write exported 4 rows to 4 file(s), dataset/replies/ holding one file per ticket named from its subject (including one with spaces and a comma), each body the reply text — alongside the aggregate board.csv and replies.md.