feat: add safe calendar import and export

Add explicit noninteractive CLI transfer modes with full event validation, idempotent duplicate handling, collision refusal, atomic import backups, and no-overwrite export creation.

Cover pure merge semantics and end-to-end rollback paths for unsupported content, invalid identities, conflicts, option combinations, and existing destinations.

docs/PRODUCT.md

@@ -81,7 +81,7 @@ The full terminal is treated as a responsive canvas:
 
 The first usable foundation supports day and appointment navigation, a
 full-frame reader, a read-only 42-day agenda, validated add/edit/delete forms,
-and atomic `.ics` writes.
+atomic `.ics` writes, and explicit non-interactive calendar import/export.
 Dense days keep every appointment keyboard-reachable even when all lines do
 not fit in the cell. Unknown or unsupported iCalendar content makes a source
 read-only instead of being discarded. Saves reject external changes, retain a
@@ -101,6 +101,27 @@ agenda. Agenda navigation never persists state, and add/edit/delete remain in
 the month workflow. The next local-data work adds advanced recurrence overrides
 and rule editing.
 
+## Local file interchange
+
+Import and export are explicit command-line workflows. They never contact the
+network and do not enter the interactive TUI.
+
+- `nocal --import SOURCE --calendar TARGET` atomically merges events into the
+  target. Exact same-UID, same-field events are duplicates and are skipped. A
+  differing same-UID event, an empty or duplicate UID or invalid event interval
+  in either file, or content in either file that cannot be safely round-tripped
+  rejects the complete import before the target is written. A successful
+  merge keeps the target's exact previous bytes as its adjacent `.bak`; a
+  duplicate-only import leaves both target and backup untouched.
+- `nocal --export DESTINATION --calendar SOURCE` validates the source and
+  atomically creates a canonical calendar. It never overwrites an existing
+  destination and refuses any source whose events are invalid or that cannot
+  be safely round-tripped.
+
+The two operations are mutually exclusive and cannot be combined with demo,
+frame printing, or backup restoration. These restrictions keep destructive
+ambiguity out of automation and make every file-writing mode deliberate.
+
 ## Accessibility
 
 - Information is never encoded by color alone.