Anchor atomic JSON replacement against parent retargeting #479

Source: exact-SHA adversarial review of
#477

Classification

• Category: filesystem isolation
• Micro-category: validated-parent TOCTOU
• Severity: P2

Trigger

At commit 40a2e1a6a7ca168c26add90e23c16afab4e31d53,
_replace_same_directory validates parent identity with Path.samefile and
then calls path-based os.replace.

A deterministic adversarial sequence can:

1. target destination/nested/../manifest.json;
2. let samefile() return true;
3. replace nested with a symlink to an outside directory;
4. make path-based os.replace install the JSON outside the validated parent.

The destination leaf itself is not a symlink, so the leaf check does not stop
the parent retargeting.

Expected

• Open and retain the validated destination directory identity.
• Verify the temporary file is a regular entry in that exact directory.
• Replace source and destination relative to the same directory descriptor.
• Clean up relative to the retained directory descriptor on every failure.
• Parent path mutation after validation cannot redirect the replacement.

Acceptance

• A deterministic parent-retargeting test leaves the outside file unchanged.
• Equivalent .. spellings still succeed.
• Cross-directory temp, destination symlink, mode preservation, and all injected
  pre-replace failures remain covered.
• macOS/Linux focused tests and full CI pass.