init: relay-script, fallback policy and .gitignore writes in install_into are not confined to the project (junction/symlink escape), unlike the hook-config and skill-tree writes

[sirendhead]

Summary

install_into (src/bmad_loop/install.py) confines the hook-config write and the skill-tree writes with _confined_to (:1207, applied at :1238 and :2780), but three other writes it performs during bmad-loop init are not confined and follow whatever the destination path resolves to:

write	HEAD d489c42	v0.11.1
relay script <project>/.bmad-loop/bmad_loop_hook.py — script_target.write_text(...)	:2858	:2718
fallback policy.toml — policy_path.write_text(POLICY_TEMPLATE, ...)	:2882	(same block)
root .gitignore append — gitignore.open("a", ...)	~:2890-2900	:2750 / :2764

If <project>/.bmad-loop (or .gitignore) is a directory junction / symlink pointing outside the project, init writes into that external location and reports success. The two guarded writers already show the intended pattern; these three predate it.

Evidence

• Found by an independent QA gate (Codex, 2026-09-07) on color-kit PR sirendhead/color-kit#659 while auditing every mutation reachable from color-kit's color-dev-loop init driver, which spawns bmad-loop init as a child: "Relay script .bmad-loop/bmad_loop_hook.py: unconditional write_text, no destination confinement. Root .gitignore: append through open('a'), no destination confinement. Hook settings: parent mkdir and atomic replacement have upstream _confined_to protection. Bundled skills: ... upstream checks skill-tree confinement." Source-confirmed at the pinned v0.11.1 and at HEAD; a live child execution was not run (Linux probe stopped at a native regex dependency).
• The driver side cannot guard writes it does not perform; color-kit tracks its half as sirendhead/color-kit#679.

Suggested fix

Route the relay-script, fallback-policy and .gitignore writes through the same _confined_to + atomic-write path the hook config uses (#379 rule: atomic_write_text, never write_text), refusing with a typed error when the resolved destination leaves the project. Pin with a junction/symlink fixture in tests/test_install.py (skip cleanly where junctions cannot be created, fail loud on Windows CI).

Source

• found-in: bmad-loop@d489c42 (local clone E:\vibe-coding\bmad-loop, tool pin v0.11.1), session 957cdbc1 (CDL3 wave 1, color-dev-loop executor lane)
• while: QA gate round 4 of color-kit PR psmux 3.3.8: attended console pass for the client-movement paths, then rebase switch_client's verdict source #659 (write-containment audit of color-dev-loop init)
• evidence: src/bmad_loop/install.py:1207,1238,2780 (guarded) vs :2858,:2882,~:2890-2900 (unguarded); v0.11.1 :2718,:2750,:2764