fix(ingestor): stats .tmp writer follows a hard link to another file of the ingestor's user

[dborup]

Relates to #160, #161, #216

Problem

A hard link at <stats path>.tmp that points to another file owned by the ingestor's user passes the regular-file and owner checks in writeStatsAtomic. The writer then truncates that file, overwrites it with the stats JSON, and the rename publishes it.

• This exists on master. It was found as F6 in the fix(ingestor): rate-limited stats tmp errors, FIFO-safe writer, stale status (#160, #161) #216 review.
• The risk is low. Planting the link needs write access to the stats directory (by default /tmp), and with fs.protected_hardlinks=1 also access to the target.

Proposed fix

• After the open, refuse a tmp whose Fstat shows nlink > 1, and leave it in place.
• Report it with the same statsWriteError shape, e.g. <tmp>: hard-linked (nlink N); remove it.

Acceptance

• A Unix test with a hard link at the tmp path gets an error, the link target stays unchanged, and nothing is published.
• The existing stats-file tests stay green.

[dborup]

Additional items for the same code, from the round-2 re-review of #216 (merged). Please handle them together with the hard-link fix:

1. FIFO tests without a release guard.
   • The FIFO subtest of TestStatsWriteErrorNamesThePathOnce_160 calls writeStatsAtomic directly.
   • TestStatsFileWriterFailureLineNamesThePathOnce_160 calls stop() unguarded.
   • If fix(ingestor): a FIFO at the stats .tmp path blocks the stats writer forever #161 regressed (e.g. O_NONBLOCK dropped), both would hang until the package timeout instead of failing in seconds.
   • Route them through writeStatsAtomicOrRelease and a guarded stop.
2. The rename failure path is untested. A mutant that stops stripping the *os.LinkError survives. Add a rename-failure case to TestStatsWriteErrorNamesThePathOnce_160, such as a non-empty directory at the destination.
3. DRY. The owner detail and hint (owned by uid %d, ingestor uid %d / remove it or fix its owner) are built in both setPermissionHint and checkStatsTmpOwner. Extract one helper.

[dborup]

Fixed by #240 (merged as e0bfe955).

• The stats writer refuses a .tmp whose Fstat shows nlink > 1 and leaves it in place. The check uses the open descriptor, so the link target is never changed and nothing is published.
• The fix(ingestor): rate-limited stats tmp errors, FIFO-safe writer, stale status (#160, #161) #216 follow-ups are done:
  • the FIFO tests run through the release guard, so they fail fast instead of hanging;
  • the rename failure path is tested;
  • one helper builds the owner/permission hint.