feat(data ingest): destination-table guard (--overwrite) + honest extension handling

[LukasWodka]

Summary

Fixes the two data ingest failures that cost customers a full upload before failing (from the 2026-07-07 deep dive of the ingest flow). Stacked on #142 — retargets to develop when it merges.

1. Destination-table guard — cli#70, P4-lite of backend#828

• One cheap read (the data list query) after cluster discovery, before staging. Existing table without --overwrite → exit 6 (new, documented) with the full remedy: --overwrite, a different --table, or data delete. Previously: stage everything → submit → in-cluster DuplicateValidator fails → exit 9, upload burned.
• --overwrite replaces via the exact teardown data delete uses, acting on the matched name (not the flag's casing — Linux MySQL + PVC paths are case-sensitive; the flag spelling could silently no-op the DROP/rm and then claim success).
• --overwrite + --idempotency-key refused outright (adversarial-review catch): a replayed submit attaches to the previous run after the teardown deleted the data — false success + data loss.
• Fails open with a visible note when the check can't run (in-cluster duplicate check still backstops); honest partial-failure copy names data delete as the primary recovery; the teardown pod honors --stage-pod-image (air-gapped registries).

2. Extension detection/emission — cli#68 (P5 seed)

• .webp removed from the accept-set: the ingestor's FileExtension enum + the ingest.v1 schema allow only .jpg/.jpeg/.png for images, and FileTypeValidatorraises on webp — accepting it locally guaranteed an in-cluster failure after the full upload.
• The single shared extension is detected, shown (images: 3 files (.png)) and emitted as spec.file_options.extension, so the cluster validates the type that was actually staged. Previously it checked its .jpeg convention default and rejected .jpg/.png datasets after upload.
• Mixed types fail locally with counts (.jpg ×1, .png ×3, exit 3); all-unsupported datasets get told what was found vs accepted.

Verification

• Cross-repo traced against data-ingestors (conventions merge order, per-category validator factories incl. keypoint's top-level bridging, DuplicateValidator semantics).
• Live on a real cluster: PNG detection · guard on an existing table (exit 6, case-insensitive match reporting the real name) · --overwrite --dry-run creates nothing · mixed-extension refusal · combo-flag refusal.
• Adversarially reviewed pre-push (2 lenses); all 11 findings folded — including the replay data-loss trap, the partial-teardown 'Re-run' trap, and the case-fold/teardown mismatch.
• go build / vet / full go test ./... green; new tests pin the guard seam (matched-name contract, fail-open), extension detection, spec emission + schema validation, keypoint top-level fields, and the summary rendering.

Refs: cli#68 · cli#70 · backend#828 (P4/P5) · backend#879.

🤖 Generated with Claude Code

[LukasWodka]

👋 Heads-up — Code review queue is at 32 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#156 — feat(strategies): FedMedian Byzantine-robust aggregation (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#157 — feat(strategies): FedTrimmedAvg Byzantine-robust aggregation (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#158 — feat(strategies): Krum / MultiKrum Byzantine-robust selection (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#159 — feat(strategies): FedProx aggregation strategy (dataset push: --category help lists 5 of 9 categories, and unknown-vs-empty category errors give two different lists (one leaks unsupported segmentation) #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#160 — feat(strategies): FedOpt family — FedAdam / FedYogi / FedAdagrad (dataset push: --category help lists 5 of 9 categories, and unknown-vs-empty category errors give two different lists (one leaks unsupported segmentation) #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• backend#927 — feat(validators): schema check for tabular/text/token classification (#924 G2) · author: @divyasinghds · no reviewer assigned
• backend#931 — feat(validators): generic all-category checks + validation matrix (#924 Phase 0/G12) · author: @divyasinghds · reviewer: @saqlainsyed007
• backend#934 — feat(validators): column-level tabular/text schema diagnostics (#924 G3/G4) · author: @divyasinghds · no reviewer assigned
• backend#935 — feat(validators): time-series & survival temporal checks (#924 G8/G9) · author: @divyasinghds · reviewer: @saqlainsyed007
• backend#936 — feat(validators): text/NLP language + alignable-text checks (#924 G10) · author: @divyasinghds · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)