fix(cli): guard the whole template read, not only the open

read_file guarded open_in_bin but left in_channel_length and
really_input_string unguarded, so a path that opens but cannot be read
as bytes -- a directory -- escaped as an uncaught Sys_error and crashed
the program, leaking the open channel on every failure path. A template
is user input; it must never crash the program.

Wrap the whole read in Fun.protect so the channel closes on every path
(success, exception, early return), matching the close-on-every-path
pattern already used in the test suite. The missing-file message stays
exactly as before; a read failure after a successful open now carries
the exception text, the same path: exception shape Layer.load and
Overlay.load already use.

New cram case points --template at a directory (the sandbox's own cwd,
not /tmp) and asserts one stderr line and exit 2, not a crash.

1 files changed, 9 insertions, 0 deletions

diff --git a/test/cli.t b/test/cli.t
index 73eefc1..c5aeb98 100644
--- a/test/cli.t
+++ b/test/cli.t
@@ -537,6 +537,15 @@ A missing template file is an error:
   colitur: cannot read template /tmp/nope.txt
   [2]
 
+Pointing --template at a directory is an error, not a crash: the read
+itself is guarded, not only the open (F1, fix round 1). "." is used rather
+than a fixed /tmp path so this does not depend on anything outside the
+cram sandbox itself:
+
+  $ colitur table --year 2027 --template . --flavour none
+  colitur: cannot read template .: Sys_error("Value too large for defined data type")
+  [2]
+
 table and render both require --year and --template:
 
   $ colitur table --year 2027