fix(code): eliminate save-time owner-check path race #134

The owner-only verification added in #107 checks the temporary path after chmod even though the file is already open. A concurrent rename/name swap can therefore make the path-based stat inspect a different inode from the descriptor that later receives the worker identity or quarantine record. The read path already avoids this split by using handle.stat(). Verify the save-time mode through the open file descriptor as well, and add a regression test for the swapped-name case.