feat: guard frozen split products against silent overwrite (--force)

tests/unit/test_video_split_cli.py

@@ -303,3 +303,29 @@ def test_git_short_sha_nonempty():
     sha = cli.git_short_sha()
     assert sha
     assert len(sha) >= 4
+
+
+def test_build_split_refuses_overwrite_without_force(tmp_path):
+    """已存在指纹不同的 pools.json 时，force=False 必须报错不覆盖。"""
+    from app.harness.build_split import _guard_frozen_products
+
+    out_path = tmp_path / "pools.json"
+    out_path.write_text('{"split_mode":"global"}', encoding="utf-8")
+    manifest_path = tmp_path / "split_manifest.json"
+
+    with pytest.raises(FileExistsError, match="已存在冻结产物"):
+        _guard_frozen_products(out_path, manifest_path, force=False)
+
+
+def test_build_split_force_backs_up_old(tmp_path):
+    """force=True 时旧产物被备份为 .bak.* 再允许覆盖。"""
+    from app.harness.build_split import _guard_frozen_products
+
+    out_path = tmp_path / "pools.json"
+    out_path.write_text('{"old":1}', encoding="utf-8")
+    manifest_path = tmp_path / "split_manifest.json"
+    manifest_path.write_text('{"pools_sha256":"deadbeef00000000"}', encoding="utf-8")
+
+    _guard_frozen_products(out_path, manifest_path, force=True)
+    baks = list(tmp_path.glob("pools.json.bak.*"))
+    assert len(baks) == 1, f"未备份旧产物: {list(tmp_path.iterdir())}"