fix: prevent partial dependency output

[bdice]

Summary

• split dependency generation into explicit request-building, rendering, and publishing phases
• render every requested output in memory before printing, cleaning, or writing files
• group pyproject updates by canonical destination, loading and serializing each TOML document once
• delay CLI --clean until rendering succeeds
• add regressions for partial stdout/files, existing files, pyproject composition, path aliases, independent pyproject targets, and failed clean operations

Root cause

make_dependency_files() published each result from inside its generation loop. If a later matrix entry or output raised a validation or rendering error, earlier results from the same invocation had already been printed or written.

The new pipeline first resolves generation requests, then renders all outputs without mutations, and finally publishes the completed result. Requirements and conda files render independently. Pyproject requests targeting the same file share one in-memory TOML document, including when their configured paths are lexical or symlink aliases.

This guarantees that generation-time errors do not emit stdout, create or overwrite output files, or remove files requested through --clean. Write-time operating-system failures remain outside the multi-file guarantee.

Validation

• pytest -q (87 passed)
• pinned pre-commit hooks on all changed files (passed)
• exact KvikIO reproduction at 58f358a0ccb16c39bec53d6a02030db11665e503: nonzero exit with zero stdout and the original map-input error
• git diff --check

Context

Discovered while investigating rapidsai/kvikio#996, where an invalid requirements mapping was correctly rejected but downstream orchestration retained other partial outputs. The companion orchestration fix is rapidsai/devcontainers#736.