fix: apply only confirmed style rewrites

[imakris]

style_pipeline.py --write advertised confirmed fixes but ran every fixer unconditionally. On an already green vnm_plot tree that changed six files, exited zero, and left the no-write pipeline red.

This change:

• pre-checks each fixable rule and skips its fixer when already green
• retains fail-fast precheck/fix/postcheck behavior for confirmed failures
• performs one complete final read-only sweep after any fixer ran
• returns nonzero on cross-stage invalidation instead of auto-looping
• adds runner and concrete condition/hanging fixed-point regression tests

Validation:

• python tests/test_style_tools.py: 576/576 green
• vnm_plot@2ec8013 no-write: green
• vnm_plot@2ec8013 --write: green with zero file changes
• original dirty standards checkout was not modified