feat(durability): pin directory synchronization

[steipete]

What Problem This Solves

Fixes an issue where consumers performing crash-safe file or directory publication had to reimplement directory identity pinning, parent-edge synchronization, and platform-specific unsupported handling. File synchronization alone does not make a newly created, linked, renamed, or removed directory entry durable.

Why This Change Was Made

Adds a focused @openclaw/fs-safe/durability subpath with pinned directory receipts, strict async and sync directory synchronization, explicitly named best-effort variants, and guarded durable creation of nested directory paths. The implementation rejects final symlinks, FIFOs, path replacement, canonical-path drift, and descriptor/path identity mismatch. Known Windows directory-flush limitations return an explicit unsupported outcome, while directory-open access failures and POSIX I/O errors remain strict.

Existing best-effort root, pinned-write, and sibling-temp behavior is preserved and routed through the shared primitive. Application commit markers, permission policy, and decisions about accepting unsupported platforms remain caller-owned.

User Impact

Consumers can build crash-consistent publication protocols without duplicating low-level directory handle and identity logic. The change is additive; existing APIs and defaults keep their current compatibility behavior.

Evidence

• Node 24 pnpm check: 45 test files passed, 494 assertions passed, 4 platform skips; build, file-size guard, filesystem-boundary guard, and tarball/import verification passed.

• pnpm test:coverage: package thresholds passed; the new directory durability module has 90% line coverage and 82.5% branch coverage.

• 33 focused assertions cover nested parent-edge sync order, custom creation, existing identities, symlink and FIFO replacement, transient path swaps, POSIX failure propagation, Windows open-vs-sync classification, synchronous behavior, best-effort compatibility, and public exports.

• Final Codex autoreview: no accepted/actionable findings.

• git diff --check passed.

• Tests added or updated when behavior changed

• Security and compatibility impact considered

• CHANGELOG.md updated when release-relevant

• No credentials, private paths, private hosts, or sensitive contents included

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat(durability): pin directory synchronization This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.